A critical path traversal vulnerability in Tenda i9 firmware version 1.0.0.5(2204) allows unauthenticated remote attackers to bypass authentication and access sensitive administrative pages.

The vulnerability exists in the R7WebsSecurityHandler function of the HTTP server, which fails to properly validate URL paths after verifying whitelisted prefixes. By using directory traversal sequences, such as "../", an unauthenticated attacker can circumvent the whitelist and access restricted administrative files.

Successful exploitation grants an unauthenticated attacker direct access to administrative interfaces and sensitive system files. This exposure can lead to full device compromise, unauthorized configuration changes, or the exfiltration of sensitive network information, presenting a significant security risk to the integrity of the managed infrastructure. The CVSS score of 7.3 reflects the high impact of unauthorized access to critical administrative functions.

Immediate Action: Contact the vendor for available firmware updates and apply them immediately to the affected hardware. If no patch is currently available, restrict management interface access to trusted administrative networks only.

Proactive Monitoring: Monitor network traffic for HTTP requests containing directory traversal patterns, such as sequences of "../", directed at the device management interface. Review server access logs for requests to sensitive files that do not originate from authorized internal IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an edge security appliance configured to inspect and block HTTP requests containing directory traversal sequences. Ensure the device management interface is not exposed to the public internet.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked research write-up by Li Tengzheng.

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate attention. Administrators must prioritize isolating the affected Tenda i9 devices from untrusted networks and coordinating with the vendor to obtain the necessary firmware updates to remediate this authentication bypass flaw.