CVE-2026-5962
CRITICALCVSS 9.8/10EPSS 0.54%
Last modified
CVE-2026-5962 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A vulnerability was detected in Tenda CH22 1.0.0.6(468). This issue affects the function R7WebsSecurityHandlerfunction of the component httpd. EPSS estimates a 0.54% chance of exploitation in the next 30 days.
Description
A vulnerability was detected in Tenda CH22 1.0.0.6(468). This issue affects the function R7WebsSecurityHandlerfunction of the component httpd. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tenda | Ch22 Firmware | 1.0.0.6\(468\) |
References
- https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_55/README.mdExploit, Third Party Advisory
- https://vuldb.com/submit/791277Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/356515Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/356515/ctiPermissions Required, VDB Entry
- https://www.tenda.com.cn/Product
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-5962?
A vulnerability was detected in Tenda CH22 1.0.0.6(468). This issue affects the function R7WebsSecurityHandlerfunction of the component httpd. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.
How severe is CVE-2026-5962?
CVE-2026-5962 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 0.54% probability of exploitation in the next 30 days.
How do I fix CVE-2026-5962?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-59612In buffering_period of avc_decoder, there is a possible Non-…
- CVE-2026-59613In multiple locations, there is a possible way to trigger an…7.5
- CVE-2026-59614In multiple functions of oem_svc_setup.c, there is a possibl…
- CVE-2026-59616In prev_run_vcore of hwcodec_firmware, there is a possible N…
- CVE-2026-59618In smfc_v4l2_s_selection of smfc-v4l2-ioctls.c, there is a p…
- CVE-2026-59619In getCodecQp of GC2AV1Enc.cpp, there is a possible way to t…
- CVE-2026-59623In CompareTelUris of SipAddress.cpp, there is a possible way…7.5
- CVE-2026-59624In multiple locations, there is a possible way to trigger an…
- CVE-2026-59625In GetTwiddledMiptreeSparsePageMap of texmgmt.c, there is a …
- CVE-2026-59626In SendInfo of UssiController.cpp, there is a possible way t…
- CVE-2026-59628In s_copy_host_apb_param of multiple files, there is a possi…
- CVE-2026-5963EasyFlow .NET developed by Digiwin has a SQL Injection vulne…9.8
Are you affected by CVE-2026-5962?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST