Tenda router firmware contains undocumented admin backdoor

A significant security vulnerability has been discovered in several older Tenda networking devices, exposing them to complete takeover by attackers. The flaw, an undocumented authentication backdoor embedded in the firmware, allows anyone with knowledge of a hidden password to gain full administrative control of a device's web management interface, regardless of the owner's configured credentials.

The vulnerability, tracked as CVE-2026-11405, was disclosed by the CERT Coordination Center (CERT/CC) at Carnegie Mellon University. It affects five specific firmware versions used in a range of Tenda routers, including the FH1201, W15E, AC10, AC5, and AC6 models. According to the advisory, the backdoor is present in the login function of the devices' web server software. When a login attempt fails the standard authentication check, the system retrieves an alternate password value stored in the device's configuration. It then compares the user-supplied password against this stored value in plaintext. A successful match grants "role2" administrative access and creates a valid session. Critically, the associated username is not validated, meaning any username will work when paired with...