# CVE-2026-11405: Tenda Firmware authentication backdoor in httpd login function

Source: https://junglewise.ai/threats/cve-2026-11405-tenda-firmware-authentication-backdoor-in-httpd-login-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-11405 · Severity: info · CVSS 9.8 · Published 2026-07-06

Multiple Tenda networking devices contain a hidden backdoor in their web management interface. This allows an attacker to bypass normal security checks and gain full administrative control of the device without knowing the owner's password. Once in control, an attacker can monitor network traffic, change security settings, or use the device as a foothold to attack other systems on the local network.

Technologies: [Tenda AC10 firmware](https://junglewise.ai/threats/technologies/ac10-firmware), [Tenda Ac6 Firmware](https://junglewise.ai/threats/technologies/ac6-firmware), [Tenda FH1201 firmware](https://junglewise.ai/threats/technologies/fh1201-firmware). Vendors: [Tenda](https://junglewise.ai/threats/vendors/tenda).

## Quick answers

**Is CVE-2026-11405 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11405 being exploited in the wild.

**How severe is CVE-2026-11405?** Informational severity, with a CVSS score of 9.8, published 6 July 2026.

**Which products and versions are affected?** Tenda AC10 firmware V15.03.06.46_multi_TDE01; Tenda AC5 firmware V15.03.06.48_multi_TDE01; Tenda Ac6 Firmware V15.03.06.51_multi_T; Tenda FH1201 firmware V1.2.0.14(408)_EN_TD; and 1 more.

**Is there a fix for CVE-2026-11405?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11405 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-11405?** Check whether you run Tenda AC10 firmware, Tenda AC5 firmware, Tenda Ac6 Firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A hidden backdoor exists in the login() function of the /bin/httpd binary. While the application normally uses MD5-based password verification, a secondary check is performed if the primary authentication fails. The function retrieves a password from the device configuration (sys.rzadmin.password) and performs a plaintext strcmp() comparison against the user-provided password. If they match, the user is granted administrative privileges (role=2) and a valid session is created. This bypass does not validate the username, meaning any username paired with the configuration-stored password will grant access. No patch is currently available from the vendor.

## Affected products

- Tenda AC6 firmware V15.03.06.51_multi_T
- Tenda AC5 firmware V15.03.06.48_multi_TDE01
- Tenda AC10 firmware V15.03.06.46_multi_TDE01
- Tenda W15E firmware V15.11.0.5(1068_1567_841)_EN_TDE
- Tenda FH1201 firmware V1.2.0.14(408)_EN_TD

## Timeline

- 2026-05-19: other: Vendor notified by CERT/CC
- 2026-07-06: disclosed: Public disclosure via CERT/CC and NVD

## References

- [https://cwe.mitre.org/data/definitions/912.html](https://cwe.mitre.org/data/definitions/912.html)
- [https://kb.cert.org/vuls/id/213560](https://kb.cert.org/vuls/id/213560)

## Related threats

- [Tenda AC6 OS command injection in get_log_file](https://junglewise.ai/threats/cve-2026-8265-tenda-ac6-os-command-injection-in-get-log-file)
- [Tenda AC6 OS command injection in formWifiApScan](https://junglewise.ai/threats/cve-2026-8264-tenda-ac6-os-command-injection-in-formwifiapscan)
- [Tenda AC6 OS command injection in /goform/telnet](https://junglewise.ai/threats/cve-2026-8259-tenda-ac6-os-command-injection-in-goform-telnet)
- [Tenda AC6 buffer overflow in formSetCfm](https://junglewise.ai/threats/cve-2025-52221-tenda-ac6-buffer-overflow-in-formsetcfm)
- [Tenda AC10 stack buffer overflow in fromSysToolChangePwd](https://junglewise.ai/threats/cve-2026-5550-tenda-ac10-stack-buffer-overflow-in-fromsystoolchangepwd)