Tenda router firmware backdoor enables unauthenticated admin access

Tenda router firmware backdoor enables unauthenticated admin access

A critical security vulnerability identified as CVE-2026-11405 has exposed a significant number of Tenda-branded networking devices to unauthorized administrative control. The flaw, which was disclosed by the CERT Coordination Center under Vulnerability Note VU#213560 on July 6, 2026, involves a hardcoded backdoor embedded directly within the device firmware.

The vulnerability resides in the web server component of the affected routers, specifically within the /bin/httpd binary. Researchers found that the device’s login() function contains an alternate authentication path. While the device typically relies on MD5-based credential verification, the system is programmed to fall back on a secondary password check if the primary authentication fails. This mechanism retrieves a stored password from the device configuration using the GetValue("sys.rzadmin.password") function. If a user provides this specific string, the device bypasses standard security protocols, ignores the username requirement, and grants full administrative privileges (role=2).

This bypass is entirely undocumented in official Tenda materials and remains invisible to users through the standard administrative interface. The vulnerability affects multiple Tenda models and firmware versions, including:

• US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD
• US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE
• US_AC10V1.0re_V15.03.06.46_multi_TDE01
• US_AC5V1.0RTL_V15.03.06.48_multi_TDE01
• US_AC6V2.0RTL_V15.03.06.51_multi_T
• Tenda F3 and Tenda N300
• Firmware versions V12.01.01.48, V12.01.01.42, V12.01.01.23, V12.01.01.53, and V03.03.01.40

The implications of this flaw are severe, as the backdoor can be exploited remotely over the internet. Attackers gaining administrative access can modify network configurations, intercept traffic, disable security features, or deploy unauthorized files. There is growing evidence of active exploitation in the wild, with automated scanners reportedly probing for vulnerable devices using UDP port 7329. A public Nmap script, tenda-backdoor.nse, has facilitated these efforts, enabling both targeted and opportunistic attackers to identify and compromise routers. While no specific Advanced Persistent Threat (APT) group has been identified as the perpetrator, security experts note that such backdoors are commonly sought by sophisticated actors for network persistence and lateral movement.

Efforts to resolve the issue have stalled. According to both the CERT/CC and independent investigators, Tenda has remained unreachable for coordination, and no official firmware patch is available to mitigate the risk. Security researchers emphasize that because Tenda hardware often utilizes custom chipsets, users cannot easily swap out the vendor-provided firmware for open-source alternatives like DD-WRT.

In the absence of a patch, organizations and individuals currently using Tenda devices are urged to implement immediate defensive measures:

• Disable remote web management to prevent external access to the device interface.
• Restrict local network exposure by changing default LAN IP addresses.
• Monitor network traffic for unexplained outbound connections to suspicious IP addresses.
• Segment management interfaces to reduce the likelihood of unauthorized access.

Security analysts warn that this discovery highlights deeper concerns regarding supply chain integrity and the safety of budget networking equipment. Because many vendors rely on shared SDK codebases from chipset manufacturers like Realtek or MediaTek, similar vulnerabilities may exist in other white-label or OEM products. Consequently, security teams are advised to audit all budget networking hardware within their environments, rather than focusing solely on Tenda-branded devices. If these mitigations prove insufficient, replacing the affected hardware remains the most reliable path to securing the network edge.