A newly disclosed security vulnerability has revealed that several firmware versions for Tenda networking devices contain an undocumented authentication backdoor that could allow attackers to gain full administrative access without knowing the device’s legitimate login credentials.
The vulnerability, tracked as CVE-2026-11405, was disclosed by the CERT Coordination Center (CERT/CC), which warned that the hidden authentication mechanism bypasses the normal password verification process and grants elevated privileges to unauthorized users.
Multiple Tenda Firmware Versions Affected
According to CERT/CC, the vulnerability affects several Tenda firmware releases, including:
- US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD
- US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE
- US_AC10V1.0re_V15.03.06.46_multi_TDE01
- US_AC5V1.0RTL_V15.03.06.48_multi_TDE01
- US_AC6V2.0RTL_V15.03.06.51_multi_T
Devices running these firmware versions may be vulnerable to unauthorized administrative access.
How the Hidden Backdoor Works
Researchers discovered that the undocumented backdoor is embedded within the login() function of the device’s /bin/httpd web server binary.
Under normal conditions, the firmware authenticates users through an MD5-based password verification process. However, when authentication fails, the software follows an alternative code path instead of immediately rejecting the login attempt.
The hidden logic retrieves an alternate password stored in the device configuration using the function:
GetValue("sys.rzadmin.password")
It then performs a direct plaintext comparison between the supplied password and this hidden configuration value. If the passwords match, the device automatically creates an administrator session with elevated privileges.
Username Validation Is Completely Bypassed
One of the most concerning aspects of the vulnerability is that the associated “rzadmin” username is never actually validated.
According to CERT/CC, any username entered during login will be accepted as long as it is paired with the hidden backdoor password.
Because this authentication mechanism is undocumented and inaccessible through the standard administrative interface, most users and administrators would have no indication that it exists.
Potential Security Risks
If exploited successfully, attackers could gain unrestricted administrative access to a vulnerable device’s web management interface.
This level of access could allow malicious actors to:
- Modify router settings without authorization
- Disable built-in security protections
- Change network configurations
- Redirect network traffic
- Install persistent malicious configurations
- Completely compromise the affected device
Such access could also be used as a stepping stone for broader attacks against connected networks.
No Patch Available Yet
The vulnerability was reported by an anonymous security researcher. At the time of publication, Tenda has not released a security update to address the issue.
The Hacker News has contacted the company for comment, and additional information is expected if an official response becomes available.
Recommended Mitigation Steps
Until an official firmware update is released, users should take precautionary measures to reduce the risk of exploitation.
Recommended actions include:
- Disable remote management on affected devices.
- Change the router’s default LAN IP address.
- Restrict administrative access to trusted internal networks only.
- Regularly monitor router settings for unauthorized changes.
- Apply firmware updates immediately when Tenda releases a security patch.
Final Thoughts
The discovery of an undocumented authentication backdoor in multiple Tenda firmware versions highlights the serious risks posed by hidden functionality in network devices. Since the flaw allows attackers to bypass standard authentication and obtain full administrative control, organizations and home users should secure affected devices immediately and closely monitor for firmware updates from Tenda.
