A critical path traversal vulnerability in Tenda CH22 firmware (version 1.0.0.1) allows unauthenticated attackers to bypass authentication and access sensitive administrative functions.

The vulnerability resides in the R7WebsSecurityHandler function, which improperly validates URL prefixes intended for unauthenticated access. By combining a whitelisted prefix with directory traversal sequences, an unauthenticated remote attacker can access restricted system pages.

The ability for an unauthenticated attacker to access administrative pages creates a significant risk of unauthorized system configuration, firmware manipulation, or full device takeover. With a CVSS score of 7.3, this high-severity flaw poses a direct threat to the integrity and availability of the network infrastructure managed by this device.

Immediate Action: Since a specific patch version is not currently listed, administrators should restrict management access to the device to trusted internal networks only, or disable remote management interfaces entirely. Contact Tenda support for information regarding firmware updates that resolve the R7WebsSecurityHandler flaw.

Proactive Monitoring: Monitor device access logs for suspicious HTTP requests containing directory traversal patterns, such as sequences of dots and slashes (e.g., ../) directed at the web management interface.

Compensating Controls: Deploy a Web Application Firewall or an edge security device to filter and block incoming HTTP requests that contain directory traversal sequences directed at the router management port.

Public Exploit Available: Yes — a functional proof-of-concept script has been published via the researcher's GitHub repository.

Given the availability of a public proof-of-concept and the potential for full administrative compromise, this vulnerability should be treated with high priority. Organizations utilizing Tenda CH22 devices must implement strict network segmentation to limit exposure and immediately seek firmware guidance from the vendor to remediate the underlying flaw.