A backdoor (CVE-2026-11405) has been identified in firmware used in consumer and industrial routers, switches, wireless access points, and video surveillance systems from Tenda, enabling access to the web interface with administrative rights bypassing the standard authentication process, regardless of the administrator account settings. The access rights granted allow management of all settings, manipulation of traffic, disabling of safeguards, and use of the device as a launchpad for attacks on systems within the local network.
The issue is caused by undocumented functionality in the process /bin/httpd embedded in the login() function. If the standard password hash verification fails for any login, the code calls the GetValue("sys.rzadmin.password") function, which checks the password against a value predefined in the firmware in plain text. If there is a match, a session with administrative privileges is created regardless of the specified login.
To exploit the backdoor, access to send requests to the device via HTTP or HTTPS is sufficient. As a workaround, it is recommended to block access to the built-in HTTP server from external networks.
The problem has been confirmed in the following firmware:
- US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD
- US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE
- US_AC10V1.0re_V15.03.06.46_multi_TDE01
- US_AC5V1.0RTL_V15.03.06.48_multi_TDE01
- US_AC6V2.0RTL_V15.03.06.51_multi_TDE01
Source: opennet.ru
