Undocumented Tenda firmware backdoor allows unauthorized administrative access via specific password bypass

Summary

Security researchers have identified an undocumented authentication backdoor within several versions of T니다 firmware. The vulnerability, tracked as CVE-2026-11405, resides in the web server's login function and allows attackers to bypass standard credential verification to gain administrative access to a device's management interface.

The flaw affects various networking products, including routers and switches. Successful exploitation enables an attacker to modify device configurations, alter network settings, and disable security features, which can lead to the compromise of the entire local network.

Technical details

The vulnerability is located in the /bin/httpd web server binary within the login() function. Under normal circumstances, the function follows a standard authentication path that uses MD5-based password verification via functions such as prod_encode64, PasswordToMd5, and check_rand_key.

However, if the initial authentication attempt fails, the mechanism triggers an alternate logic path. It calls GetValue("sys.rzadmin.password") to retrieve a specific password stored in the device configuration. The system then performs a direct strcmp() comparison between this retrieved value and the user-supplied password in plaintext.

If the passwords match, the system grants the user role=2 (administrative) access and establishes a valid session. Crucially, the mechanism does not validate the username; any provided username will succeed as long as it is paired with the correct backdoor password. This entire process remains invisible through any standard administrative interface.

Affected products and fixed versions

The vulnerability affects multiple versions of Tenda firmware. While the full scope of affected hardware is still being determined, the following specific versions have been identified:

| Product/Firmware Version | Status | | :--- than | :--- | | US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD | Unpatched | | US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE | Unpatched | | US_AC10V1.0re_V15.03.06.46_multi_TDE01 | Unpatched | | US_AC5V1.0RTL_V15.03.06.48_multi_TDE01 | Unpatched | | US_AC6V2.0RTL_V15.03.06.51_multi_T | Unpatched |

Why this matters for defenders

This is a critical-severity flaw because the backdoor provides total control over the networking hardware. An attacker who successfully exploits this can intercept traffic, redirect users, or disable security controls on the local network.

Because the vulnerability exists in the core web server binary used for management, it represents a significant risk to both home and business environments. Furthermore, the CERT Coordination Center reported that they were unable to coordinate with Tenda regarding this disclosure, meaning defenders cannot rely on an official update in the near future.

Defender guidance

Since no patch is currently available, defenders should implement the following mitigations to reduce the attack surface:

• Disable Remote Management: If your device allows web management access from the internet (WAN side), disable this feature immediately. This prevents external attackers from reaching the vulnerable login function.
• Change Default LAN IP: Changing the default local IP address of your network can help hide the device from automated scanners that target known default IP ranges, though this does not stop targeted attacks.

What remains unclear

The specific "backdoor password" required to trigger the strcmp() match has not been made public in the provided documentation. Additionally, while several firmware versions are listed, the full list of all Tenda products containing this specific /bin/httpd binary remains unconfirmed.