A backdoor (CVE-2026-11405) has been identified in firmware used in Tenda consumer and industrial routers, switches, wireless access points, and video surveillance systems. This backdoor allows access to the web interface with administrator privileges, bypassing the standard authentication process and regardless of the administrator account settings. This access allows for management of all settings, manipulation of traffic, disabling security measures, and using the device as a springboard for attacks on systems on the local network.
The issue was caused by an undocumented feature embedded in the login() function in the /bin/httpd process. If the standard MD5 password hash check failed for any login, the code called the GetValue("sys.rzadmin.password") function, which checked whether the password matched the value predefined in the firmware in cleartext. If a match was found, regardless of the specified login, a session with administrator privileges was created.
To exploit the backdoor, access to send requests to the device via HTTP or HTTPS is sufficient. As a workaround, it is recommended to block access to the firmware's built-in HTTP server from external networks.
The problem has been confirmed in the following firmware versions:
- US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD
- US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE
- US_AC10V1.0re_V15.03.06.46_multi_TDE01
- US_AC5V1.0RTL_V15.03.06.48_multi_TDE01
- US_AC6V2.0RTL_V15.03.06.51_multi_TDE01
Source: opennet.ru
