The vulnerability resides in the R7WebsSecurityHandlerfunction of Tenda i9’s HTTP handler and allows an attacker to manipulate path inputs, resulting in a path traversal flaw (CWE‑22). By forging requests, an adversary can read sensitive files residing on the device’s storage. The flaw is an information disclosure vulnerability that can be triggered remotely through the device’s web interface. Remote exploitation is feasible and publicly available exploits may already be in circulation.

Tenda i9 firmware 1.0.0.5 (build 2204). No other firmware revisions are listed as affected, and the vulnerability is tied exclusively to the HTTP handler component exposed by this model.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not present in the CISA KEV catalog, implying no confirmed widespread exploitation has been recorded. However, because the attack vector is remote and relies on simple HTTP requests, a determined attacker can attempt traversal patterns to read files from the device. Effective mitigation relies on preventing unauthorised web access or applying a vendor provided patch if available.