Hidden Backdoor in Tenda Router Firmware

Endpoint Safety

Unauthenticated Flaw Permits Full Router, Community Takeover

Greg Sirico •
July 8, 2026    

A hidden backdoor present in firmware bought by Chinese language networking {hardware} producer Tenda allows unauthenticated administrative entry and management over units by net administration interfaces.

See Additionally: Beat the Breach: Outsmart Attackers and Safe the Cloud

Embedded within the net server binary /bin/httpd, the flaw, tracked as CVE-2026-11405, maintains an undocumented backdoor throughout the login() operate and requires no validated credentials for entry. {Hardware} tools usually reliant on web-based, username and password protected interfaces prohibit unauthorized configuration changes and different system modifications. The backdoor makes use of this built-in limitation to take advantage of the firmware’s regular authentication path.

Exploiting the flaw, reported by the CERT Coordination Middle out of Carnegie Mellon College earlier this week, begins with an ordinary MD5-based password verification path. When authentication fails, the backdoor reverts to an alternate code path, using GetValue("sys.rzadmin.password") to generate and pull a brand new password worth from the system configuration.

In plaintext, the flaw initiates a strcmp() comparability between the user-supplied password and the configuration-stored worth, granting function=2 admin-level entry and creating a legitimate session if the values match.

Based on CERT/CC, the related “rzadmin” username is “not validated,” that means any username offered will go unchecked and acquire entry if paired with a backdoor-generated worth. “This backdoor authentication mechanism is just not documented or seen by any administrative interface,” mentioned CERT/CC.

The flaw presently holds no CVSS rating and isn’t listed within the CISA-managed Identified Exploited Vulnerabilities catalog.

If efficiently exploited, the backdoor would allow attackers to totally reconfigure units, together with altering community settings and disabling security measures, and will rapidly escalate to community compromise. Regardless of no KEV itemizing, exploitation is being noticed within the wild by researchers monitoring the problem intently, discovered cybersecurity agency Rescana.

Primarily based on experiences, a publicly obtainable Nmap NSE script – tenda-backdoor.nse – is drastically widening the assault floor. The script “automates detection and exploitation by way of UDP port 7329,” scanning for susceptible units.

Site visitors across the flaw reveals suspicious exterior IP addresses contacting routers and “storing unexplained information,” along with outbound connections between already “compromised routers” and suspicious exterior infrastructure.” The backdoor follows a typical assault path: credential interception, session hijacking and deployment of unauthorized code onto affected units.

No patch is accessible as of publication however customers are suggested to disable distant administration instruments on affected Tenda units and replace the default LAN IP handle to restrict community publicity and scale back automated scans from choosing up default, exploitable IP ranges.

Till patching is feasible and firmware is up to date, customers also needs to phase administration interfaces and monitor networks for unauthorized makes an attempt to entry UDP port 7329, reviewing present router configurations for sys.rzadmin.password inclusion.

The vulnerability itself, which presently impacts the FH1201, W15E, AC10, AC5 and AC6 router households, was initially reported by an nameless researcher who, by CERT/CC, notified Tenda of the continuing risk.