{"id":182505,"date":"2026-07-07T16:53:19","date_gmt":"2026-07-07T14:53:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora"},"modified":"2026-07-07T16:53:19","modified_gmt":"2026-07-07T14:53:19","slug":"bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","title":{"rendered":"Backdoor in Tenda firmware allows administrative access","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A backdoor (CVE-2026-11405) has been identified in firmware used in consumer and industrial routers, switches, wireless access points, and video surveillance systems from Tenda, enabling access to the web interface with administrative rights bypassing the standard authentication process, regardless of the administrator account settings. The access rights granted allow management of all settings, manipulation of traffic, disabling of safeguards, and use of the device as a launchpad for attacks on systems within the local network. <\/p>\n

The issue is caused by the presence of undocumented functionality in the process \/bin\/httpd, embedded within the login() function. If the standard hash-based MD5 password check fails for any login, the code invokes the function GetValue(\u00absys.rzadmin.password\u00bb), which checks for a password match against a value predefined in the firmware in plain text. If there is a match, a session with administrative rights is created, regardless of the specified login. <\/p>\n

To exploit the backdoor, access to send requests to the device via HTTP or HTTPS is sufficient. As a workaround, it is recommended to block access to the built-in HTTP server from external networks. <\/p>\n

The problem has been confirmed in the following firmware: <\/p>\n