CVE-2026-11405

nvd.nist.gov • July 9, 2026

This CVE record is not being prioritized for NVD enrichment efforts due to resource or other concerns.

The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8. - The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key). - After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configuration. - It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password. A successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Backdoor Vulnerability in Tenda Routers Exposes Admin Access A critical vulnerability, CVE-2026-11405, has been discovered in multiple Tenda router firmware versions, allowing unauthenticated attackers to gain full administrative control via a hidden backdoor. This flaw exists in the /bin/httpd binary, where the login() function bypasses standard authentication mechanisms by retrieving a hidden password from device configurations. Affected models include the FH1201, W15E, AC10, AC5, and AC6 series. No patch is currently available, and exploitation attempts are already underway, with automated scanners probing for vulnerable devices. Security advisories recommend disabling remote management and changing default LAN IPs to mitigate risks. The vulnerability has been confirmed by CERT/CC, and public proof-of-concept code has emerged, further escalating the threat landscape. 10 sources 70

Extracted Entities

CVE-2026-11405

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)