Executive brief
Multiple Tenda networking devices contain a hidden backdoor in their web management interface. This allows an attacker to bypass normal security checks and gain full administrative control of the device without knowing the owner's password. Once in control, an attacker can monitor network traffic, change security settings, or use the device as a foothold to attack other systems on the local network.
Technical details
A hidden backdoor exists in the login() function of the /bin/httpd binary. While the application normally uses MD5-based password verification, a secondary check is performed if the primary authentication fails. The function retrieves a password from the device configuration (sys.rzadmin.password) and performs a plaintext strcmp() comparison against the user-provided password. If they match, the user is granted administrative privileges (role=2) and a valid session is created. This bypass does not validate the username, meaning any username paired with the configuration-stored password will grant access. No patch is currently available from the vendor.
Affected products
- Tenda AC6 firmware V15.03.06.51_multi_T
- Tenda AC5 firmware V15.03.06.48_multi_TDE01
- Tenda AC10 firmware V15.03.06.46_multi_TDE01
- Tenda W15E firmware V15.11.0.5(1068_1567_841)_EN_TDE
- Tenda FH1201 firmware V1.2.0.14(408)_EN_TD
Timeline
- 2026-05-19: other: Vendor notified by CERT/CC
- 2026-07-06: disclosed: Public disclosure via CERT/CC and NVD