Security Advisory: Undocumented Authentication Backdoor in Tenda Firmware

Vulnerability Identifier: VU#213560 | CVE ID: CVE-2026-11405 Release Date: 2026-07-06 | Last Updated: 2026-07-06

📌 Executive Overview

A critical security flaw has been discovered across multiple versions of Tenda firmware. This vulnerability consists of a hidden authentication backdoor that allows unauthorized individuals to gain full administrative privileges via the device's web-based management portal.

By exploiting CVE-2026-11405, an attacker can completely bypass standard password verification, granting them total control over the hardware without needing legitimate credentials.

⚠️ Affected Firmware Versions

The following specific versions are confirmed to be vulnerable:

• US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD
• US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE
• US_AC10V1.0re_V15.03.06.46_multi_TDE01
• US_AC5V1.0RTL_V15.03.06.48_multi_TDE01
• US_AC6V2.0RTL_V15.03.06.51_multi_TDE

---

🛠 Technical Analysis

Tenda produces a wide array of networking hardware, including switches, wireless access points, routers, and surveillance gear. These devices typically utilize a web interface for configuration, which is intended to be secured by a username and password.

The Backdoor Mechanism

The vulnerability resides within the /bin/httpd web server binary, specifically inside the login() function. The authentication logic follows a flawed two-step process:

1. Standard Path: The system first attempts a routine authentication check using an MD5-based password hash.
2. Backdoor Path: If the initial check fails, the system does not immediately deny access. Instead, it executes GetValue("sys.rzadmin.password") to fetch a secondary, hidden password from the device's internal configuration.

The system then performs a plaintext comparison using strcmp(). If the user-provided password matches this hidden value, the system assigns role=2 (Administrative Access) and initializes a session.

Crucially, the username provided is entirely ignored; any username will work as long as the backdoor password is correct.

Logic Flow Visualization

Mathematical Representation of the Flaw

The vulnerability can be viewed as a logical OR gate where the security is only as strong as the weakest password: $\text{Access} = (\text{Password} == \text{MD5\_Hash}) \lor (\text{Password} == \text{rzadmin\_password})$

Pseudo-code Implementation

// Simplified representation of the vulnerability in /bin/httpd
int login(char *user, char *pass) {
    if (verify_md5(pass) == SUCCESS) {
        return GRANT_ACCESS;
    } else {
        char *backdoor_pass = GetValue("sys.rzadmin.password");
        if (strcmp(pass, backdoor_pass) == 0) {
            set_role(2); // Assign Admin privileges
            return GRANT_ACCESS;
        }
    }
    return DENY_ACCESS;
}

---

💥 Impact Assessment

If successfully exploited, the consequences are severe. An attacker gains full administrative control over the web interface. This allows them to:

• Modify critical device configurations.
• Manipulate network settings (DNS, routing, etc.).
• Disable existing security protocols.
• Use the device as a pivot point to compromise other assets on the local network.

---

🛡 Mitigation and Solutions

Important: CERT/CC was unable to establish contact with Tenda to coordinate a formal patch. Consequently, no official firmware update is currently available to resolve this issue.

Users are strongly encouraged to implement the following workarounds:

• Disable Remote Management: Turn off the feature that allows the web dashboard to be accessed from the WAN/Internet. This prevents external attackers from reaching the login page.
• Restrict Local Exposure: Change the default LAN IP address. While this won't stop a determined attacker, it can hide the device from basic automated scanners targeting default IP ranges.

---

📋 Administrative Details

Vendor Status Table

Reference Links

• CISA Project Upskill - Module 5
• Tenda Download Center
• DoD Best Practices for Home Network Security

Acknowledgements: This vulnerability was reported by an anonymous researcher.

---

Contact Information:

• SEI: 412-268-5800
• CERT/CC: cert@cert.org
• Location: Carnegie Mellon University, Pittsburgh, PA 15213-2612