A hidden authentication backdoor has been discovered in multiple versions of Tenda router firmware, potentially allowing attackers to gain administrator access to the device’s web management panel. The issue remains unfixed due to an inability to contact the Chinese manufacturer.
The vulnerability, tracked as CVE-2026-11405 by the CERT Coordination Center (CERT/CC), lies within the ‘login()’ function of the ‘/bin/httpd’ web server binary. This function contains an undocumented authentication mechanism that allows attackers to bypass standard MD5-based login verification. If a user attempts to log in, the firmware will first perform standard authentication. However, if this fails, it will retrieve an alternate password from the ‘sys.rzadmin.password’ configuration value and compare it directly to the plaintext password entered by the remote user.
This means that as long as the backdoor password is supplied, any username can be accepted by the mechanism, granting administrator access to the device’s web interface. With this level of control, an attacker can reconfigure the router, alter network settings, and disable security features, potentially compromising the entire local network.
The affected firmware versions include several models of Tenda WiFi routers: FH1201, W15E, AC10, AC5, and AC6 V2. Unfortunately, no patch is currently available, and users are advised to disable remote web management access to prevent attackers from exploiting this vulnerability. Additionally, it’s recommended that local network exposure be restricted by changing the default LAN IP address to reduce opportunistic discovery by automated scanners.
The existence of this backdoor has significant implications for internet security, particularly in light of recent reports on botnets targeting router flaws. It is likely that malicious actors will target CVE-2026-11405 in the coming period. While no active exploitation has been reported, users should take immediate action to mitigate this risk and protect their networks.
In practical terms, users can minimize their exposure by regularly updating firmware and closely monitoring network activity for signs of unauthorized access. Furthermore, it’s essential to prioritize robust security measures, including multi-factor authentication and regular vulnerability scans. By taking proactive steps to secure their devices and networks, individuals and organizations can reduce the likelihood of falling victim to this type of attack.
Source: Bleeping Computer — 2026-07-07