Read the docs
TI-2026-09842 Aliases CVE-2026-11405GHSA-w55r-jjxw-gxrx

Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows…

Priority MEDIUM 50Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8. - The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key). - After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configuration. - It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password. A successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00765 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TendafirmwareUS_AC6V2.0RTL_V15.03.06.51_multi_T—No fix listedCNA
TendafirmwareUS_AC5V1.0RTL_V15.03.06.48_multi_TDE01—No fix listedCNA
TendafirmwareUS_AC10V1.0re_V15.03.06.46_multi_TDE01—No fix listedCNA
TendafirmwareUS_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE—No fix listedCNA
TendafirmwareUS_FH1201V1.0BR_V1.2.0.14(408)_EN_TD—No fix listedCNA
  • firmware VendorTenda Affected US_AC6V2.0RTL_V15.03.06.51_multi_T Fixed in — No fix listed CNA
  • firmware VendorTenda Affected US_AC5V1.0RTL_V15.03.06.48_multi_TDE01 Fixed in — No fix listed CNA
  • firmware VendorTenda Affected US_AC10V1.0re_V15.03.06.46_multi_TDE01 Fixed in — No fix listed CNA
  • firmware VendorTenda Affected US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE Fixed in — No fix listed CNA
  • firmware VendorTenda Affected US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11405
  2. 2026-10-03 Alias added: GHSA-w55r-jjxw-gxrx

References

Other 2

  • TI-2021-11772 An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-08863 The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-10434 An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-78650 Stack-based buffer overflow in Tenda AC19 web management service CVSS 4.0CRITICAL 10.0
  • TI-2026-66119 Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow CVSS 4.0CRITICAL 10.0
  • TI-2026-57025 Tenda AC18 Telnet telnet missing authentication CVSS 4.0CRITICAL 10.0
See all 1963 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences