CERT/CC has uncovered an undocumented backdoor in multiple Tenda router firmware versions, allowing unauthorized administrative access. This vulnerability, tracked as CVE-2026-11405, poses significant security risks as attackers can bypass authentication and control devices remotely.
The CERT Coordination Center (CERT/CC) has warned about an undocumented authentication backdoor present in several Tenda router firmware versions. The vulnerability, tracked as CVE-2026-11405, could allow attackers to gain full administrative control without valid credentials.
The backdoor is located within the 'login()' function of the '/bin/httpd' web server binary. It initially uses MD5 for password verification but subsequently allows a different code path if this process fails, leading to unauthorized administrative access. The method fetches a hidden password from the device's configuration and performs a plaintext comparison, ignoring valid username checks.
The presence of this backdoor enables complete control over the router's web management interface. An attacker could alter settings, disable security features, or fully take control of the device, presenting serious risks to network security for users.
As of now, the vulnerability remains unpatched. Users of affected Tenda router firmware versions are recommended to disable remote management features and change the default LAN IP address to mitigate potential exploitation risks. Tenda has been contacted for further comments regarding this issue.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
CERT/CC has uncovered an undocumented backdoor in multiple Tenda router firmware versions, allowing unauthorized administrative access. This vulnerability, tracked as CVE-2026-11405, poses significant security risks as attackers can bypass authentication and control devices remotely.