CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware

The CERT Coordination Center (CERT/CC) has issued a warning about an undocumented authentication backdoor in multiple versions of Tenda router firmware. The vulnerability, tracked as CVE-2026-11405, allows an attacker to bypass password verification and gain full administrative control over the device’s web management interface without valid credentials.

The backdoor is embedded in the /bin/httpd web server binary, specifically within the login() function. When normal MD5-based authentication fails, the function retrieves an alternate password from the device configuration via GetValue(“sys.rzadmin.password”) and performs a direct plaintext comparison with the user-supplied password. If they match, the application grants admin-level access (role=2) and creates a valid session with elevated privileges. The associated username rzadmin is not validated, so any username will succeed when paired with the backdoor password.

Successful exploitation allows an attacker to remotely modify settings, disable security features, or reconfigure the device, potentially leading to a complete device takeover. The vulnerability remains unpatched as of writing. Users are advised to disable remote management and change the default LAN IP address to mitigate risk.