CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware

Summary: CERT/CC warned Monday that several versions of Tenda router firmware contain an undocumented authentication backdoor, tracked as CVE-2026-11405, that grants full administrative control of the web management interface without valid credentials. The flaw sits in the login() function of the /bin/httpd binary, which falls back to a plaintext comparison against a stored "sys.rzadmin.password" value when normal MD5 verification fails, accepting any username and creating an admin-level session (role=2).
What you should know: The backdoor is undocumented, invisible in any administrative interface, and unpatched as of writing, so a device with remote management exposed can be taken over by anyone who reaches it. CERT/CC's interim guidance - disable remote management and change the default LAN IP - is the only mitigation available until Tenda responds.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-11405
Related: ⚡ Weekly Recap: Share File Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026