# Critical Undocumented Backdoor Discovered in Tenda Router Firmware—Vendor Unreachable for Fix


A severe authentication bypass vulnerability has been discovered in multiple Tenda router firmware versions, granting attackers complete administrative control over affected devices. The flaw, tracked as CVE-2026-11405, is particularly alarming because it appears to be an intentional backdoor mechanism, remains unpatched, and the router manufacturer has proven impossible to contact for remediation.


## The Threat


CERT/CC issued a security advisory on July 7, 2026, warning of a hidden authentication backdoor embedded in the web management interface of Tenda networking equipment. The vulnerability allows any attacker with network access to the router's management portal to gain full administrative privileges using a secret password stored within the device firmware—regardless of the router's configured administrator credentials.


"Successful exploitation grants full administrative access to the device's web interface,"** CERT/CC cautioned, **"enabling an attacker to reconfigure the device, alter network settings, and disable security features, thereby enabling broader compromise of the local network."


## What is Tenda?


Tenda is a Chinese networking equipment manufacturer known for producing affordable WiFi routers and networking devices marketed primarily through retail channels and online marketplaces. While not as widely recognized as brands like TP-Link or Netgear in enterprise environments, Tenda routers have found significant adoption among small businesses, home users, and budget-conscious organizations seeking cost-effective networking solutions.


This accessibility and price point made Tenda routers popular targets for previous security researchers, with the company's firmware historically plagued by various vulnerabilities. However, the discovery of an apparent intentional backdoor marks a significant escalation in concerns about the vendor's security practices.


## Technical Details of the Backdoor


The vulnerability resides in the login() function of the /bin/httpd web server binary that handles administrative authentication. The authentication logic implements a two-stage verification process:


1. Primary check: The router first attempts standard MD5-based authentication, validating the username and password against the device's configured administrator account.


2. Backdoor fallback: If standard authentication fails, the firmware retrieves an alternate password from a hidden configuration parameter—sys.rzadmin.password—and compares it directly to the plaintext password supplied by the remote user.


If this backdoor password matches, the router grants full administrator (role=2) privileges and establishes a valid session—regardless of which username was entered.


This design is particularly insidious for several reasons:


| Characteristic | Impact |

|---|---|

| Undocumented | No legitimate use case is documented; users have no way to know the mechanism exists |

| Non-obvious hardcoded value | The sys.rzadmin.password parameter suggests an intentional system feature, not an accidental flaw |

| Universal access | Any username combined with the backdoor password grants admin rights |

| No visibility | The administrative interface provides no indication that alternative authentication methods are available |


According to CERT/CC, this mechanism was never publicly disclosed and does not appear in any official Tenda documentation or user guidance.


## Affected Devices and Versions


CVE-2026-11405 impacts at least five Tenda router models across multiple firmware versions:


| Model | Affected Firmware Version |

|-------|--------------------------|

| Tenda FH1201 | US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD |

| Tenda W15E | US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE |

| Tenda AC10 | US_AC10V1.0re_V15.03.06.46_multi_TDE01 |

| Tenda AC5 | US_AC5V1.0RTL_V15.03.06.48_multi_TDE01 |

| Tenda AC6 V2 | US_AC6V2.0RTL_V15.03.06.51_multi_T |


CERT/CC has not yet provided confirmation that these represent the complete list of vulnerable devices or firmware versions. Given the apparent intentional nature of the backdoor, it is plausible that the mechanism exists across a broader range of Tenda products.


## Implications for Organizations and Users


The severity of this vulnerability cannot be overstated. A compromised router represents a critical security perimeter failure—an attacker with admin access can:


  • Intercept and redirect traffic for phishing or man-in-the-middle attacks
  • Disable local firewalls and security features to allow lateral movement into connected devices
  • Deploy malware to devices on the network
  • Harvest credentials and sensitive data passing through the network
  • Reconfigure DNS settings to direct users to malicious sites
  • Establish persistent backdoors for ongoing unauthorized access

    • For small businesses relying on Tenda routers for their primary network infrastructure, this vulnerability represents an open door to comprehensive network compromise. A single exploited router could become the pivot point for a devastating breach affecting all connected systems.


    ## Why the Vendor Remains Unreachable


    CERT/CC's advisory notes that Tenda could not be reached for comment or to coordinate a patch. This represents a significant gap in the coordinated disclosure process and raises troubling questions:


  • Has Tenda's security contact information become outdated?
  • Are communication channels between Chinese manufacturers and Western security coordinators insufficient?
  • Does Tenda lack resources or organizational capacity to respond to critical security disclosures?

    • The inability to reach the vendor also suggests that no patch is currently available, and users cannot expect official remediation in the near term.


    ## Current Workarounds and Recommendations


    Because no patch exists, CERT/CC recommends a multi-layered defensive approach:


  • Disable remote web management: Ensure the web management interface is not accessible from the internet; restrict access to the local network only
  • Change default LAN IP address: Modify the router's default LAN IP to reduce opportunistic discovery by automated network scanners
  • Network segmentation: Isolate IoT and networking infrastructure on separate network segments from critical business systems
  • Access control: Implement firewall rules to restrict management port access (typically port 80/443) to trusted administrative devices only
  • Consider replacement: Organizations heavily reliant on Tenda equipment should begin evaluating migration to equipment from vendors with demonstrated security responsiveness

    • ## Broader Security Context and Botnet Risk


    While no reports of active exploitation currently exist, CERT/CC's advisory strongly implies that the vulnerability will be prioritized by botnet operators. Router compromises are among the most valuable targets in the exploit economy—a single compromised router can provide access to dozens or hundreds of downstream devices, making it an excellent return on investment for attackers.


    The continued discovery of router vulnerabilities suggests that this category of network infrastructure remains severely under-resourced in terms of security development and patch management across the entire industry.


    ---


    ## HackWire Analysis


    The Tenda backdoor represents a watershed moment in router security—the apparent intentionality of this vulnerability suggests either deliberate manufacturer backdoor implementation or catastrophic negligence in firmware development practices. The timing is particularly concerning given the industry-wide shift toward working-from-home infrastructure that has made home and small-office routers critical security perimeters.


    What's striking is not merely the vulnerability's existence, but its design: the sys.rzadmin.password parameter name and the fallback authentication chain suggest this was a known feature, not an accidental oversight. This raises uncomfortable questions about whether this mechanism was placed for manufacturer remote access, law enforcement access, or something else entirely. Regardless of intent, it has now become an attack surface.


    More broadly, this incident exposes a critical gap in the vendor ecosystem: Chinese networking equipment manufacturers often lack the organizational infrastructure, English-language support channels, and security coordination protocols that Western security researchers expect. When CERT/CC cannot reach a vendor, coordinated disclosure breaks down entirely—and users are left to fend for themselves.


    For defenders, this underscores why defense-in-depth matters desperately. A compromised router should not mean a compromised network. Assume routers are adversary territory, segment traffic accordingly, and treat network edge devices with the same suspicion you'd apply to any externally-facing system.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)