{"id":182505,"date":"2026-07-07T16:53:19","date_gmt":"2026-07-07T14:53:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora"},"modified":"2026-07-07T16:53:19","modified_gmt":"2026-07-07T14:53:19","slug":"bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","title":{"rendered":"Bakd\u00f6r i Tenda-firmware som m\u00f6jligg\u00f6r administrat\u00f6rstillg\u00e5ng.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>I firmware som anv\u00e4nds i konsument- och industriella routrar, switchar, tr\u00e5dl\u00f6sa \u00e5tkomstpunkter och \u00f6vervakningssystem fr\u00e5n Tenda har en bakd\u00f6rr (CVE-2026-11405) uppt\u00e4ckts, vilket m\u00f6jligg\u00f6r \u00e5tkomst till webbgr\u00e4nssnittet med administrat\u00f6rsr\u00e4ttigheter utan att g\u00e5 igenom den normala autentiseringsprocessen och oavsett inst\u00e4llningarna f\u00f6r administrat\u00f6rskontot. De tilldelade beh\u00f6righeterna g\u00f6r det m\u00f6jligt att hantera alla inst\u00e4llningar, manipulera trafiken, st\u00e4nga av skyddsmekanismer och anv\u00e4nda enheten som en plattform f\u00f6r att attackera system i det lokala n\u00e4tverket.    <\/p>\n<p>Problemet orsakades av att det fanns en icke-dokumenterad funktionalitet i processen \/bin\/httpd, inb\u00e4ddad i funktionen login(). Om den normala verifieringen av l\u00f6senordet misslyckades f\u00f6r n\u00e5got anv\u00e4ndarnamn, anropades funktionen GetValue(\u00absys.rzadmin.password\u00bb), som kontrollerade matchningen mellan l\u00f6senordet och v\u00e4rdet som f\u00f6rdefinierades i firmware i klartext. Om det fanns en matchning skapades en session med administrativa r\u00e4ttigheter, oavsett det angivna anv\u00e4ndarnamnet.    <\/p>\n<p>F\u00f6r att anv\u00e4nda bakd\u00f6rren kr\u00e4vs det att man har tillg\u00e5ng till enheten f\u00f6r att skicka beg\u00e4rningar via HTTP eller HTTPS. Som en skydds\u00e5tg\u00e4rd rekommenderas det att blockera \u00e5tkomst till den inbyggda HTTP-servern i firmware fr\u00e5n externa n\u00e4tverk.     <\/p>\n<p>Problemets f\u00f6rekomst har bekr\u00e4ftats i f\u00f6ljande firmware:  <\/p>\n<ul>\n<li> US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD\n<li> US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE\n<li> US_AC10V1.0re_V15.03.06.46_multi_TDE01\n<li> US_AC5V1.0RTL_V15.03.06.48_multi_TDE01\n<li> US_AC6V2.0RTL_V15.03.06.51_multi_TDE01  <\/ul>\n<p>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=65856\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430\u0445, \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0442\u043e\u0447\u043a\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0434\u0435\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tenda, \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 (CVE-2026-11405), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0432 \u043e\u0431\u0445\u043e\u0434 \u0448\u0442\u0430\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u041f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0432\u0441\u0435\u043c\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438, \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c, \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182505","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430\u0445, \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0442\u043e\u0447\u043a\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0434\u0435\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tenda, \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 (CVE-2026-11405), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 Tenda, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430\u0445, \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0442\u043e\u0447\u043a\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0434\u0435\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tenda, \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 (CVE-2026-11405), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-07T14:53:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-07T14:53:19+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bakd\u00f6rr i Tenda-firmwaren som m\u00f6jligg\u00f6r \u00e5tkomst med administrat\u00f6rsr\u00e4ttigheter | ProHoster","description":"I firmware som anv\u00e4nds i konsument- och industriella routrar, switchar, tr\u00e5dl\u00f6sa \u00e5tkomstpunkter och \u00f6vervakningssystem fr\u00e5n Tenda har en bakd\u00f6rr (CVE-2026-11405) uppt\u00e4ckts, vilket m\u00f6jligg\u00f6r \u00e5tkomst.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u044d\u043a\u0434\u043e\u0440 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 Tenda, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445, \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u0430\u0445, \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u0442\u043e\u0447\u043a\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0432\u0438\u0434\u0435\u043e\u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tenda, \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 (CVE-2026-11405), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/bekdor-v-proshivkah-tenda-pozvolyayushhij-poluchit-dostup-s-pravami-administratora","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-07-07T14:53:19+00:00","article:modified_time":"2026-07-07T14:53:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182505","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:08","updated":"2026-08-05 12:22:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/182505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=182505"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/182505\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=182505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=182505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=182505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}