CyberSecurity News

CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware

The Hacker News

· July 7, 2026

AI summary

The CERT Coordination Center has warned of a hidden admin backdoor in the firmware of certain Tenda routers. This backdoor allows for administrative access to the devices' web management interfaces. The vulnerability can be exploited to bypass password verification, giving an attacker access to the device. The issue affects several versions of Tenda's firmware and has been assigned a CVE identifier. An attacker can use this vulnerability to gain unauthorized access to the router's management interface.

Vulnerabilities mentioned

CVE-2026-11405

UNKNOWN

The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8. - The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key). - After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configuration. - It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password. A successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor

Read the full article at The Hacker Newsthehackernews.com/2026/07/certcc-warns-of-hidden-admin-backdoor.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.