Tia N.List

Reported by 2 outlets

CVE-2026-11405: Tenda Router Firmware Hidden Backdoor — No Patch Available

hot0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
4.90 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.08 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
bleepingcomputer.comsocfortress.medium.com CVE-2026-11405 first seen 98d ago

Timeline

  1. original reporting

    CVE-2026-11405: Tenda Router Firmware Hidden Backdoor — No Patch Available

    bleepingcomputer.com · 98d ago · July 8th, 2026

    CERT/CC has disclosed a hidden authentication backdoor (CVE-2026-11405) in multiple Tenda router firmware versions. The undocumented mechanism in the login() function of /bin/httpd checks an alternate password from sys.rzadmin.password if standard MD5 authentication fails. If the backdoor password matches, full administrative access is granted regardless of the username entered.

    Affected devices include Tenda FH1201, W15E, AC10, AC5, and AC6 V2 routers. No patch is available because Tenda could not be reached by CERT/CC. Users should disable the remote web management panel and change the default LAN IP address to reduce scanner discovery.

    Recommended action: Disable remote web management on all Tenda routers immediately. Block internet access to the management interface. Consider replacing Tenda devices if possible.

  2. update from socfortress.medium.com

    Unpatched Backdoor in Tenda Router Firmware (CVE-2026-11405)

    socfortress.medium.com · 96d ago · July 10th, 2026

    The /bin/httpd login function contains a fallback code path that performs plaintext strcmp() against a hidden configuration variable (sys.rzadmin.password) if MD5-based authentication fails, granting role=2 (root-equivalent) admin access. Tenda was notified on May 19, 2026 but has not issued a patch or response. No user-facing mitigation exists beyond disabling remote management — the backdoor is baked into the binary.

Source on GitHub