{"id":182505,"date":"2026-07-07T16:53:19","date_gmt":"2026-07-07T14:53:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora"},"modified":"2026-07-07T16:53:19","modified_gmt":"2026-07-07T14:53:19","slug":"bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/novosti-interneta\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","title":{"rendered":"Tenda firmware-l\u0259rind\u0259 administrator h\u00fcquqlar\u0131 il\u0259 daxil olma\u011fa imkan ver\u0259n arka qap\u0131","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Tenda \u015firk\u0259tinin istehlak\u00e7\u0131 v\u0259 s\u0259naye routerl\u0259ri, switch-l\u0259ri, simsiz giri\u015f n\u00f6qt\u0259l\u0259ri v\u0259 videom\u00fc\u015fahid\u0259 sisteml\u0259rind\u0259 istifad\u0259 olunan proqram t\u0259minatlar\u0131nda, m\u00fcvafiq r\u0259q\u0259msal identifikatorla (CVE-2026-11405)  administrator imtiyazlar\u0131 il\u0259 web-interfeys\u0259 giri\u015f imkan\u0131 ver\u0259n bir arxa qap\u0131 a\u015fkar edilmi\u015fdir. Bu imtiyazlar b\u00fct\u00fcn parametrl\u0259ri idar\u0259 etm\u0259y\u0259, trafiki manipulyasiya etm\u0259y\u0259, t\u0259hl\u00fck\u0259sizlik t\u0259dbirl\u0259rini s\u00f6nd\u00fcrm\u0259y\u0259 v\u0259 cihaz\u0131 lokal \u015f\u0259b\u0259k\u0259l\u0259rd\u0259 sisteml\u0259r\u0259 h\u00fccum etm\u0259k \u00fc\u00e7\u00fcn istifad\u0259 etm\u0259y\u0259 imkan tan\u0131y\u0131r.    <\/p>\n<p>Problemin s\u0259b\u0259bi \/bin\/httpd prosesind\u0259 login() funksiyas\u0131na daxil edilmi\u015f s\u0259n\u0259dl\u0259\u015fdirilm\u0259mi\u015f bir funksionall\u0131\u011f\u0131n m\u00f6vcudlu\u011fudur. MD5 algoritmas\u0131 \u0259sas\u0131nda hash il\u0259 h\u0259r hans\u0131 bir istifad\u0259\u00e7i ad\u0131 \u00fc\u00e7\u00fcn standart parol yoxlamas\u0131 u\u011fursuz olarsa, kodda sistemd\u0259 yerl\u0259\u015fdirilmi\u015f parolun a\u00e7\u0131q \u015f\u0259kild\u0259 \u0259vv\u0259lc\u0259d\u0259n t\u0259yin edilmi\u015f d\u0259y\u0259ri il\u0259 m\u00fcqayis\u0259sini yoxlayan GetValue(\u00absys.rzadmin.password\u00bb) funksiyas\u0131 \u00e7a\u011f\u0131r\u0131l\u0131r. \u018fg\u0259r parol uy\u011fun g\u0259lirs\u0259, g\u00f6st\u0259ril\u0259n istifad\u0259\u00e7i ad\u0131ndan as\u0131l\u0131 olmayaraq, administrator h\u00fcquqlar\u0131 il\u0259 sessiya yarad\u0131l\u0131r.    <\/p>\n<p>Arxa qap\u0131n\u0131 istifad\u0259 etm\u0259k \u00fc\u00e7\u00fcn cihaz\u0131n HTTP v\u0259 ya HTTPS-y\u0259 sor\u011fu g\u00f6nd\u0259rm\u0259k \u00fc\u00e7\u00fcn giri\u015f\u0259 malik olmaq kifay\u0259tdir. Qoruma t\u0259klifi olaraq, proqram t\u0259minat\u0131na daxil edilmi\u015f HTTP-server\u0259 xarici \u015f\u0259b\u0259k\u0259l\u0259rd\u0259n m\u00fcraci\u0259ti qada\u011fan etm\u0259k t\u0259klif olunur.     <\/p>\n<p>Problemin \u00fcz\u0259 \u00e7\u0131xmas\u0131 a\u015fa\u011f\u0131dak\u0131 proqram t\u0259minatlar\u0131nda t\u0259sdiql\u0259nmi\u015fdir:  <\/p>\n<ul>\n<li> US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD\n<li> US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE\n<li> US_AC10V1.0re_V15.03.06.46_multi_TDE01\n<li> US_AC5V1.0RTL_V15.03.06.48_multi_TDE01\n<li> US_AC6V2.0RTL_V15.03.06.51_multi_TDE01  <\/ul>\n<p>M\u0259nb\u0259: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=65856\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430\u0445, \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0442\u043e\u0447\u043a\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0434\u0435\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tenda, \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 (CVE-2026-11405), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0432 \u043e\u0431\u0445\u043e\u0434 \u0448\u0442\u0430\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u041f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0432\u0441\u0435\u043c\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c, \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182505","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430\u0445, \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0442\u043e\u0447\u043a\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0434\u0435\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tenda, \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 (CVE-2026-11405), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/az\/blog\/novosti-interneta\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"az_AZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 Tenda, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430\u0445, \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0442\u043e\u0447\u043a\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0434\u0435\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tenda, \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 (CVE-2026-11405), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/az\/blog\/novosti-interneta\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-07T14:53:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-07T14:53:19+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tenda proqram t\u0259minat\u0131nda administrator h\u00fcquqlar\u0131 il\u0259 giri\u015f imkan\u0131 ver\u0259n arxa qap\u0131 | ProHoster","description":"Tenda \u015firk\u0259tinin istehlak\u00e7\u0131 v\u0259 s\u0259naye routerl\u0259ri, switch-l\u0259ri, simsiz giri\u015f n\u00f6qt\u0259l\u0259ri v\u0259 videom\u00fc\u015fahid\u0259 sisteml\u0259rind\u0259 a\u015fkar edilmi\u015f arxa qap\u0131 (CVE-2026-11405) administrator h\u00fcquqlar\u0131 il\u0259 giri\u015f imkan\u0131 verir.","canonical_url":"https:\/\/prohoster.info\/az\/blog\/novosti-interneta\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 Tenda, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430\u0445, \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0442\u043e\u0447\u043a\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0434\u0435\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tenda, \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 (CVE-2026-11405), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/az\/blog\/novosti-interneta\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-07-07T14:53:19+00:00","article:modified_time":"2026-07-07T14:53:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182505","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:08","updated":"2026-08-05 12:22:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/182505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=182505"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/182505\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=182505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=182505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=182505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}