CVE-2026-11405
Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface
Description
The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8. - The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key). - After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configuration. - It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password. A successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor
CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:NUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:HAvailabilityAffected Products
Exploitability
References
- ⚡ Weekly Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and Moreen·The Hacker News·
- 13th July – Threat Intelligence Reporten-us·Check Point Research·
- В прошивках роутеров Tenda нашли бэкдорru-ru·Хакер (xakep.ru)· Source-only·
- Unpatched Backdoor in Tenda Firmware Grants Admin Access to Devicesen-us·SecurityWeek·
- Hidden backdoor in Tenda router firmware grants admin accessen-us·BleepingComputer·
- CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmwareen·The Hacker News· Summary only·
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-11405 and every CVE in our database. Create a free account — no credit card required.
Create Free Account