CERT/CC has uncovered a hidden authentication backdoor in several Tenda router firmware versions, allowing attackers to obtain full administrative control of the web management panel. No fix is currently available, prompting users to disable remote management and change default LAN settings as immediate mitigations.

A recent security bulletin from the CERT Coordination Center (CERT/CC) has identified a covert authentication backdoor in multiple Tenda router firmware releases, catalogued as CVE‑2026‑11405. The flaw resides in an undocumented code path inside the /bin/httpd web‑server binary's login() function. When a login attempt fails the standard MD5‑based check, the firmware falls back to a secret password stored in the sys.rzadmin.password configuration variable and compares it directly to the plaintext password supplied by the remote user.

Technical Details

If the fallback password matches, the router instantly creates a valid session with role=2 (administrator) privileges, irrespective of the username entered. This mechanism is not documented anywhere in Tenda’s public manuals nor displayed on the administrative interface, leaving users unaware of the latent risk.

Affected Devices

The following Tenda models and firmware builds are confirmed to contain the backdoor:

  • FH1201 – US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD
  • W15E – US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE
  • AC10 – US_AC10V1.0re_V15.03.06.46_multi_TDE01
  • AC5 – US_AC5V1.0RTL_V15.03.06.48_multi_TDE01
  • AC6 V2 – US_AC6V2.0RTL_V15.03.06.51_multi_T

Mitigation Recommendations

At present, Tenda has not released a patch. CERT/CC advises owners to take two immediate actions:

  1. Disable the remote web‑management interface to block Internet‑originated access.
  2. Change the default LAN IP address, reducing the chance that automated scanners will discover the vulnerable device.

Additional hardening steps include blocking unnecessary ports at the firewall, enabling network‑level access controls, and employing strong, unique passwords for any remaining local accounts.

Industry Response and Outlook

The vulnerability was reported anonymously to CERT/CC and, while there is no public evidence of active exploitation, security analysts warn that botnets targeting router flaws could quickly adopt this backdoor. BleepingComputer has reached out to Tenda for comment; a response has not yet been published.

This incident underscores the growing importance of transparency in firmware development. As IoT devices proliferate, hidden authentication pathways become high‑value targets for nation‑state actors and cyber‑criminals alike. Users should stay vigilant by regularly checking for firmware updates, replacing default credentials, and, where possible, enabling multi‑factor authentication on management interfaces.