CVE-2026-11405: Tenda Firmware authentication backdoor in httpd login function

CVE-2026-11405 · Severity: info · CVSS 9.8 · Published 2026-07-06

Multiple Tenda networking devices contain a hidden backdoor in their web management interface. This allows an attacker to bypass normal security checks and gain full administrative control of the device without knowing the owner's password. Once in control, an attacker can monitor network traffic, change security settings, or use the device as a foothold to attack other systems on the local network.

Technologies: Tenda AC10 firmware, Tenda Ac6 Firmware, Tenda FH1201 firmware. Vendors: Tenda.

Quick answers

Is CVE-2026-11405 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-11405 being exploited in the wild.
How severe is CVE-2026-11405?
Informational severity, with a CVSS score of 9.8, published 6 July 2026.
Which products and versions are affected?
Tenda AC10 firmware V15.03.06.46_multi_TDE01; Tenda AC5 firmware V15.03.06.48_multi_TDE01; Tenda Ac6 Firmware V15.03.06.51_multi_T; Tenda FH1201 firmware V1.2.0.14(408)_EN_TD; and 1 more.
Is there a fix for CVE-2026-11405?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11405 attacked?
It is attacked over the network, in device firmware.
Am I affected by CVE-2026-11405?
Check whether you run Tenda AC10 firmware, Tenda AC5 firmware, Tenda Ac6 Firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A hidden backdoor exists in the login() function of the /bin/httpd binary. While the application normally uses MD5-based password verification, a secondary check is performed if the primary authentication fails. The function retrieves a password from the device configuration (sys.rzadmin.password) and performs a plaintext strcmp() comparison against the user-provided password. If they match, the user is granted administrative privileges (role=2) and a valid session is created. This bypass does not validate the username, meaning any username paired with the configuration-stored password will grant access. No patch is currently available from the vendor.

Affected products

  • Tenda AC6 firmware V15.03.06.51_multi_T
  • Tenda AC5 firmware V15.03.06.48_multi_TDE01
  • Tenda AC10 firmware V15.03.06.46_multi_TDE01
  • Tenda W15E firmware V15.11.0.5(1068_1567_841)_EN_TDE
  • Tenda FH1201 firmware V1.2.0.14(408)_EN_TD

Timeline

  • 2026-05-19: other: Vendor notified by CERT/CC
  • 2026-07-06: disclosed: Public disclosure via CERT/CC and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.