The back door of Tenda: administrative access without credentials in several versions of firmware CVE-2026-11405

Researchers have detected a hidden access mechanism in several versions of the Chinese manufacturer Tenda's router firmware that allows you to avoid the authentication of the web panel and obtain administrative privileges without valid credentials; vulnerability appears as CVE-2026-11405 and, according to the public notice, he was still without a patch at the time of the report.

The failure lies in the authentication function of the web binary (/ bin / httpd): the login process seems to follow the normal MD5-based verification first, but if that check fails the code it activates an alternative route that consults an internal configuration field called sys.rzadmin.password and compare the clear text of the stored value to the password that the attacker introduces. If they agree, a session is created with administrative role(role = 2) and, notably, the user name is not valid, so any identifier combined with that hidden password provides administrative access.

From the operational point of view this has serious implications: an attacker who discovers or guesses that value can remotely reconfigure the equipment, deactivate security mechanisms, insert malicious network rules or even install alternative firmware; all of this without the need for the credentials of the legitimate administrator. In addition, as the back door is implemented in the firmware itself, a simple restart or factory restoration may not eliminate vulnerability if a corrected version is not installed.

The affected models and buildings identified in the report include variants with names such as US _ FH1201V1.0BR _ V1.2.0.14 (...), US _ W15EV1.0br _ V15.11.0.5 (...), and several ACx series with the suffixes V15.03.06.xx, although the complete list can be extended if more building is discovered with the same implementation. The finding was submitted by an investigator who preferred to remain anonymous and, according to the note, Tenda was contacted to comment.

As immediate mitigation measures, it is recommended disable remote access / remote management the router from the web interface and block the port of administration on the edge of the network to prevent access from WAN. Change the default IP LAN address and place the domestic or IoT devices in a separate network or VLAN reduces the probability of discovery by automatic scouts looking for known IP ranges and open ports.

In addition, while changing the administrative password is a common good practice, in this case such action alone may not be sufficient due to the clear text comparison mechanism; therefore it is important to combine the change of credentials with network isolation rules, firewalls that prevent external access to the administration panel and the limitation of administration to specific IP addresses if the firmware allows.

For advanced organizations and users it is worth auditing the device inventory and checking the firmware versions available in each unit from the computer's own interface or label, and preparing a road map to apply patches or, if not, replacing critical hardware if the manufacturer takes time to respond. Keeping informed about the status of the EQO and the available corrections is essential; public entry of the EQO is available to follow official updates at CVE-2026-11405 in MITRE and the manufacturer's page at Tenda to look for firmware and warnings.

If technical knowledge is available, another option is to assess the compatibility with open-source and reliable firmware, such as OpenWrt, for supported equipment, which allows greater control and visibility over the software running on the device; however, changing firmware requires caution and checking specific compatibility with the model in question ( OpenWrt). As a detection measure, review connection logs, monitor unusual HTTP requests to the management interface and use network scanners to identify devices with vulnerable versions helps to locate possible commitments.

In short, the combination of a back door in firmware and the lack of an immediate patch makes this finding a high priority risk for domestic networks and especially for environments where these devices are part of critical infrastructure. Act now, with isolation and management restrictions, and monitor the publication of vendor updates are the best defences until there is an official correction.