Hidden Backdoor in Tenda Router Firmware Grants Admin Access to Attackers
A disturbing security vulnerability has been discovered in multiple versions of Tenda router firmware, potentially allowing malicious actors to gain full administrative access to affected devices. The issue, tracked as CVE-2026-11405, is caused by an undocumented authentication mechanism that can be exploited using a backdoor password.
The problem lies within the ‘/bin/httpd’ web server binary’s ‘login()’ function, which performs standard MD5-based authentication when users attempt to log in. However, if this fails, it retrieves an alternate password from the ‘sys.rzadmin.password’ configuration value and compares it directly to the plaintext password supplied by the remote user. If the passwords match, the device grants administrator access, regardless of the username entered.
In other words, as long as the backdoor password is supplied, any username will be accepted by the mechanism, leaving users unaware of the risk. This means that an attacker could potentially gain full administrative control over the device’s web interface, reconfigure it, alter network settings, and disable security features – all without needing to know the correct administrator account credentials.
According to a security bulletin from the CERT Coordination Center, CVE-2026-11405 affects multiple Tenda firmware versions and devices, including:
* US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD – Tenda FH1201 (WiFi router)
* US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE – Tenda W15E (WiFi router)
* US_AC10V1.0re_V15.03.06.46_multi_TDE01 – Tenda AC10 (WiFi router)
* US_AC5V1.0RTL_V15.03.06.48_multi_TDE01 – Tenda AC5 (WiFi router)
* US_AC6V2.0RTL_V15.03.06.51_multi_T – Tenda AC6 V2 (WiFi router)
Unfortunately, no patch is currently available to fix the issue, and users are advised to disable the remote web management panel to prevent internet access to the vulnerable interface. Additionally, it’s recommended that they restrict local network exposure by changing the default LAN IP address to reduce opportunistic discovery by automated scanners.
While there’s currently no evidence of active exploitation, the likelihood of botnets targeting router flaws in the coming period is high. As always, security teams must stay vigilant and proactive in protecting their networks from emerging threats.
In light of this vulnerability, it’s essential for users to take immediate action to secure their devices. By disabling remote access and changing default settings, you can significantly reduce your risk of falling victim to such attacks. Remember, prevention is key – test every layer of your security before attackers do.
Source: Bleeping Computer — 2026-07-07