CVE-2026-11405: Actively Exploited Zero-Day Hidden Admin Backdoor Threatens Tenda Routers

Summary

A critical advisory describing a hidden administrative backdoor in multiple Tenda router firmware versions, tracked as CVE-2026-11405, has been released. The flaw sits in the login() function of the device's /bin/httpd web server binary and allows an unauthenticated attacker to obtain full administrative control over the affected device, bypassing the router's normal password verification entirely.

What makes this disclosure especially urgent is its status as a genuine zero-day: no official fix exists from Tenda as of this writing, and public proof-of-concept code, including an Nmap NSE scanning script, has already accelerated exploitation attempts in the wild. Organizations running affected Tenda hardware should treat this as an unpatched, actively probed vulnerability and apply the workarounds below immediately rather than waiting on a vendor release.

Vulnerability Details

CVE ID	Severity	EPSS Score	Vulnerability Type
CVE-2026-11405	Critical	Not yet scored	Use of Hard-Coded/Undocumented Credentials (Authentication Bypass Backdoor)

Although a formal CVSS score has not yet been published, the practical severity is comparable to a critical-rated flaw: the vulnerability requires no credentials, no user interaction, and grants complete administrative control of the device over its standard management interface.

Root Cause Analysis

The login() function inside /bin/httpd follows two authentication paths. The first is the documented one: user-supplied credentials are hashed and verified through the standard MD5-based routine (prod_encode64 / PasswordToMd5 / check_rand_key). If that check fails, rather than rejecting the login, the function silently falls through to a second, undocumented path.

That fallback path calls GetValue("sys.rzadmin.password") to pull an alternate password out of the device's own configuration store, then compares it against the password the attacker supplied using a direct, plaintext strcmp() , no hashing, no salting. If the two values match, the function grants role=2 (full administrative access) and issues a valid session, and critically, the username field is never validated at all. Any username paired with the correct backdoor value succeeds. Because this logic lives entirely inside the compiled binary and is never exposed through any official Tenda documentation or admin-facing setting, it is effectively invisible to normal device administration.

How CVE-2026-11405 Can Be Exploited

Exploitation requires nothing more than reaching the router's web management login endpoint. An attacker submits a standard login request with an arbitrary username and the backdoor value in place of a normal password; because the comparison happens in plaintext against a fixed configuration key rather than a per-device secret, once that value is known, it applies uniformly across every device running the vulnerable firmware. No session token, CAPTCHA, or rate-limiting stands in the way of repeated attempts, and the resulting session carries the same privileges as a legitimate administrator.

The public release of an Nmap NSE script, tenda-backdoor.nse, has turned this from a theoretical flaw into an automated one. The script fingerprints exposed Tenda devices and probes UDP port 7329, a service associated with the affected firmware, letting both opportunistic mass-scanners and targeted attackers locate and compromise vulnerable routers with minimal effort. Community reporting and independent technical analysis already describe real-world consequences: interception of credentials passing through compromised routers, session hijacking, unauthorized files appearing on device storage, and outbound connections from affected routers to suspicious external infrastructure. CVE-2026-11405 does not yet appear in CISA's Known Exploited Vulnerabilities catalog, but the combination of public exploit tooling and these observed indicators leaves little doubt that active exploitation is already underway.

Indicators tied to this backdoor:

Type	Indicator
Backdoor config key	sys.rzadmin.password
Scanning/exploitation port	UDP/7329
Public exploit tooling	tenda-backdoor.nse (Nmap NSE script)
Affected binary	/bin/httpd (login function)

Affected Versions

Device Model	Firmware Version
Tenda FH1201	US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD
Tenda W15E	US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE
Tenda AC10	US_AC10V1.0re_V15.03.06.46_multi_TDE01
Tenda AC5	US_AC5V1.0RTL_V15.03.06.48_multi_TDE01
Tenda AC6 (V2.0)	US_AC6V2.0RTL_V15.03.06.51_multi_T
Tenda F3 (300Mbps Wireless Router)	V12.01.01.48, V12.01.01.42, V12.01.01.23, V12.01.01.53
Tenda N300 (Easy Setup Router)	V03.03.01.40

Additional models running similar firmware builds derived from the same codebase may also be vulnerable, even if not yet confirmed on the affected list.

Impact

Successful exploitation hands an unauthenticated attacker the same level of control a legitimate network administrator has over the device, with consequences that extend well beyond the router itself.

1. 1. Full administrative takeover of the device's web management interface without valid credentials
2. 2. Reconfiguration of network settings, including DNS, routing, and Wi-Fi parameters
3. 3. Disabling of built-in security features, removing existing protections for the local network
4. 4. Interception of credentials and session hijacking for traffic passing through the compromised router
5. 5. Use of the router as a pivot point to reach and compromise other devices on the local network

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1190	Exploit Public-Facing Application	Initial Access (TA0001)
T1078	Valid Accounts (backdoor password grants a valid session)	Initial Access (TA0001)
T1046	Network Service Scanning	Discovery (TA0007)

Mitigation

1. 1. Disable remote web management on all affected Tenda routers to prevent access from outside the local network.
2. 2. Restrict local network exposure by changing default LAN IP addresses and segmenting management interfaces away from general user traffic.
3. 3. Monitor for unauthorized access attempts to the web interface and for scanning activity on UDP port 7329.
4. 4. Review router configurations for the presence of the sys.rzadmin.password field and watch for unexplained files or outbound connections to suspicious IP addresses.
5. 5. Apply a firmware update immediately once one is released via the Tenda official support portal.
6. 6. Replace affected devices if none of the above mitigations are feasible in your environment.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.