A newly disclosed security vulnerability affecting multiple Tenda router firmware versions has revealed the presence of a hidden authentication backdoor capable of granting attackers full administrative access without requiring legitimate login credentials.
The issue, tracked as CVE-2026-11405, was published by the CERT Coordination Center (CERT/CC) under Vulnerability Note VU#213560 on July 6, 2026. According to the advisory, the flaw exists in the web management interface of several Tenda devices and allows authentication to be bypassed through an undocumented mechanism embedded directly within the firmware.
Hidden backdoor in authentication process
Tenda routers rely on a web-based management interface protected by administrator credentials. However, researchers discovered that the firmware’s /bin/httpd web server contains an additional authentication path that is never exposed to users or documented by the vendor.
Under normal conditions, the login routine validates passwords using an MD5-based authentication process. If that check fails, the firmware unexpectedly performs a second verification by retrieving a hidden configuration value named sys.rzadmin.password.
Instead of using the standard authentication mechanism, the software directly compares the supplied password with this stored value in plaintext using a simple string comparison. If the values match, the device immediately creates an administrator session with full privileges.
Perhaps more concerning is that the username supplied during login is never validated. Any username can be used successfully, provided the hidden password matches the stored configuration value.
The result is an undocumented administrative backdoor that completely bypasses the normal password verification process.
Affected firmware versions
The vulnerability impacts the following firmware releases:
- US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD
- US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE
- US_AC10V1.0re_V15.03.06.46_multi_TDE01
- US_AC5V1.0RTL_V15.03.06.48_multi_TDE01
- US_AC6V2.0RTL_V15.03.06.51_multi_T
Potential impact
An attacker who knows or discovers the hidden password can gain unrestricted administrative access to the router’s web interface, regardless of the configured administrator credentials.
Once authenticated, an attacker could:
- Modify network and router configuration.
- Change DNS settings.
- Disable or weaken security protections.
- Create persistent access to the device.
- Potentially use the compromised router as a stepping stone for attacks against other systems on the local network.
If remote management is enabled and exposed to the internet, the risk increases significantly because the administrative interface may be reachable from outside the local network.
No security patch available
At the time of disclosure, CERT/CC stated it was unable to establish contact with Tenda to coordinate remediation. As a result, no official firmware update or security patch is currently available.
Until a fix is released, users are advised to reduce their exposure by:
- Disabling remote web management if the feature is enabled.
- Limiting access to the router’s management interface to trusted local devices.
- Changing the default LAN IP address to make automated scanning less effective, while recognizing that this does not stop targeted attacks.
Responsible disclosure
The vulnerability was reported by an anonymous security researcher. The CERT/CC advisory was authored by Bob Kemerer.
Organizations and home users running the affected firmware versions should review their router configurations and restrict administrative access wherever possible until Tenda releases a security update.
