CVE-2026-11405: A Built-In Shortcut Around Your Router’s Password
The Tenda router backdoor tracked as CVE-2026-11405 is a router firmware vulnerability where several Tenda firmware builds embed an undocumented login path in the /bin/httpd web server that lets attackers bypass normal password checks and gain full administrator access to the device’s management interface over the network.
That is not a theoretical concern; it is a design flaw that turns your router’s login page into a formality. The web server binary on affected devices includes backdoor logic inside its login() function, which first attempts the usual MD5-based password verification and then, if this fails, tries a different route. In other words, when the normal door is closed, the firmware quietly checks whether the caller knows the secret side entrance. For home network security, that is catastrophic. The router is your gatekeeper; if its own software decides that a hidden password should overrule your chosen credentials, you no longer control who gets in.
Which Tenda Firmware Versions Are Affected—and Why It’s So Dangerous
CVE-2026-11405 affects five specific firmware builds that share this undocumented admin path in /bin/httpd: US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD, US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE, US_AC10V1.0re_V15.03.06.46_multi_TDE01, US_AC5V1.0RTL_V15.03.06.48_multi_TDE01, and US_AC6V2.0RTL_V15.03.06.51_multi_T. These builds run on popular Tenda router models sold widely through mainstream online retailers, which is why this is a home network security story, not a niche enterprise bug.
Inside the login() routine, if the standard MD5 password check fails, the code calls GetValue("sys.rzadmin.password") to pull an alternate password from the configuration and compares it directly against the user-supplied password in plaintext. If there is a match, the firmware grants role=2, i.e., full administrator access, and creates a valid session—without caring about the username at all. That means any username paired with the backdoor password works. It is, in the bluntest terms, an embedded master key that overrides your own lock.
From Hidden Password to Full Takeover: How the Backdoor Can Be Exploited
This is not a subtle flaw at the edge of the system; it is a direct path to the top. An attacker who knows the baked-in password can completely bypass normal access control and obtain full administrative control without valid credentials. Successful exploitation of this username validation override gives full control over the router’s web interface regardless of whatever administrator password you have set. One security researcher has already confirmed that the backdoor works on real hardware and noted how easy it was to find the credentials.
Once inside the admin panel, an attacker can run internal network scans, harvest Wi‑Fi passcodes, reconfigure port forwarding to redirect web traffic, and disable security features. It can permit unauthorized remote modification of settings or total device takeover. The most worrying part is scope: this backdoor can be exploited remotely over the internet, not only by someone physically near your router. Given the popularity of Tenda hardware and the availability of technical details, it is reasonable to expect active exploitation attempts—not someday, but now.
No Patch, No Response: Why Users Must Act for Themselves
Despite the severity of CVE-2026-11405, there is currently no vendor fix. The vulnerability, reported by an anonymous researcher, remains unpatched as of this writing. Attempts by coordinators to reach the vendor for remediation have gone unanswered, and independent reporters seeking comment or a patch timeline have likewise received no reply. According to one coordinator, it was "unable to reach the vendor to coordinate this vulnerability".
That silence speaks loudly. Whether the backdoor was intended as a service mechanism or something more questionable is almost beside the point now. What matters is that people are running vulnerable firmware today, on routers that sit at the edge of their home network, and the vendor has not yet provided a way out. You cannot rely on a quick firmware update to rescue you. Until a patched release arrives—and you should assume that might take time—your security depends on configuration changes you control.
Immediate Mitigation: How to Protect Your Tenda Router Today
If you own any Tenda hardware, treat this as a call to action even if you are not sure which firmware you run. First, disable remote web management on the router; this is the single most important step, because it stops the backdoor from being usable directly over the internet. Second, change the default LAN IP address so your router does not sit on the obvious 192.168.x default ranges that automated scanners love to probe.
Those two moves do not remove the backdoor, but they reduce exposure by making your device harder to reach and harder to discover opportunistically. You should also log in locally, review every setting, and ensure strong, unique Wi‑Fi and admin passwords—because once a device like this is compromised, attackers can steal those too. You cannot install alternative open‑source firmware on these models due to custom chipsets, so configuration is your main defense. Ultimately, if Tenda does not deliver timely patches, many users will have to consider replacing affected routers rather than trusting a network edge device with a permanent secret key.
