Homelab Operator Advisory: CVE-2026-11405 — Hidden Admin Backdoor in Tenda Routers

Advisory Date: 2026-07-27
Threat Intelligence Classification: Public / Actionable

Risk Rating: Critical (CVSS 3.1: 9.8 per NVD; CVSS 2.0: 10.0 per PT Security/Positive Technologies)

Executive Summary

A hidden authentication backdoor has been confirmed in multiple Tenda consumer router firmware builds (CVE-2026-11405). The backdoor grants full administrative access — role=2, root-equivalent privileges on the web management daemon — without requiring valid credentials. It is triggered after a failed normal login attempt, bypasses username validation entirely, and uses a hardcoded plaintext password stored in device configuration (sys.rzadmin.password).

The affected population is substantial: Censys documented 14,049 exposed Tenda Router web interfaces as of early 2025; Shodan shows 534+ still detectable by keyword query in July 2026. Tenda has not responded to CERT/CC pre-disclosure coordination and has issued no patch as of this advisory date.

Immediate action required for any homelab operator running a Tenda router: disable remote management, audit whether your device is on the affected list, and plan to replace it with a supported product from a responsive vendor. No firmware fix exists — these devices are fundamentally broken until replaced or permanently isolated from untrusted networks.

Affected Models

The following Tenda models and firmware builds are confirmed vulnerable by CERT/CC VU#213560:

Note: CERT/CC states this list covers "only the specific builds the researcher reported." The backdoor resides in a shared /bin/httpd binary, meaning additional Tenda models built from the same firmware codebase are very likely affected but unconfirmed. February 2026 disclosures (8 CVEs across AC21/TX3/TX9 lines) and prior Tenda vulnerability patterns suggest broader impact than the official list indicates.

Technical Mechanism — How It Works

The backdoor is embedded in the /bin/httpd binary's login() function:

1. Normal auth path fails (admin password mismatch using MD5 hash comparison).
2. The firmware retrieves a value from persistent storage: sys.rzadmin.password.
3. A direct strcmp() plaintext comparison against user-supplied input is performed.
4. If the backdoor password matches, access is granted with role=2 (full admin privileges).
5. Username is never validated — any string works as long as the password is correct.

This is a CWE-912 (Hidden Functionality) vulnerability: an undocumented secondary authentication path deliberately embedded in firmware to allow vendor-level access without leaving traces through normal administrative interfaces.

The sys.rzadmin.password key name suggests "remote ZTE admin" — consistent with shared OEM firmware practices among Chinese router manufacturers who use common base code from chipset suppliers like ZTE. This matches the pattern of a hardcoded maintenance credential, not per-device keys derived from hardware identifiers.

Risk Rating and Exploitation Context

CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — score 9.8 (Critical) per NVD
CVSS 2.0 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C — score 10.0 (Critical) per Positive Technologies

Note: PT Security scored CVSS 10 for this vulnerability via their dbugs platform; the difference between NVD and PT scoring reflects methodology variance in impact assessment, not a disagreement on severity. Both rate this as Critical/Exploitable.

What attackers gain with role=2:

• Redirect all DNS queries to attacker-controlled servers (MITM, phishing campaigns)
• Disable the router firewall entirely
• Reconfigure port forwarding to tunnel external traffic internally
• Expose connected devices (IoT sensors, cameras, NAS drives) to direct internet access
• Establish persistent remote access surviving reboots via config persistence
• Use the router as a pivot point for lateral movement on the local network
• Access unauthenticated API endpoints: Wi-Fi credentials, service IDs, admin state details

Why this is especially dangerous for homelab operators:

• Homelabs often run behind a single consumer-grade gateway with limited segmentation
• IoT devices connected to budget routers are typically hard to patch or replace individually
• Many homelab operators use "set and forget" ISP-provided Tenda routers with no visibility into firmware security
• UPnP (port 1900) is widely exposed on affected models — 80%+ of Shodan's detectable Tenda devices show UPnP reachable from the internet by default

Exploitation ease: Low barrier to entry. Remote exploitation requires either:

1. The administrator has enabled "remote management" (reachable from the internet), OR
2. An attacker is on the LAN and can send crafted HTTP POST requests to the router's admin interface.

No verified public exploit code exists for direct remote exploitation, but the vulnerability mechanics are simple enough that any operator with basic HTTP tooling could test whether their device is affected.

Practical Mitigations (Ordered by Effectiveness)

1. Replace the router — definitive remediation

This is the only complete fix. The backdoor is baked into the firmware image and cannot be removed via configuration changes. If your budget allows, replace with a product from a vendor that actively patches vulnerabilities (TP-Link, Netgear newer models, Ubiquiti UniFi, or a purpose-built firewall like pfSense/OPNsense for homelab use).

2. Disable remote management — blocks internet-facing exploitation

In the router web interface: navigate to Administration → Remote Management and set it to Disabled. This prevents exploitation from the internet but does NOT protect against LAN-side attacks or compromised devices on your network.

3. Restrict admin access to trusted local networks only

If you must keep using the affected router, ensure:

• The web management interface listens ONLY on your internal LAN (not on any WAN-facing interface)
• Firewall rules block external access to ports 80, 443, and any admin port from untrusted networks
• If your ISP-provided combo device has remote management enabled by default, call the ISP and request it be disabled

4. Change LAN IP/subnet — reduces opportunistic scanner detection

If the backdoor relies on attackers finding your router via common private ranges (192.168.x.x), moving to a less conventional subnet (e.g., 10.0.0.x or 172.16.x.x) makes opportunistic scanning less likely to reach it. This is a defense-in-depth measure only — sophisticated attackers will find you regardless.

5. Network segmentation — contain blast radius

For homelab setups: place IoT devices, cameras, and non-critical systems on a separate VLAN or guest network that cannot reach the router's admin interface. Use VLAN ACLs to prevent lateral movement from compromised endpoints back to your gateway.

6. Firmware audit checklist

• [ ] Identify your router model (sticker on device, web UI About page)
• [ ] Compare firmware version against the affected list above
• [ ] Check manufacturer website for any emergency patch or advisory (none available from Tenda as of July 2026)
• [ ] Document which devices on your network route through this router
• [ ] Create a replacement procurement plan with priority ordering by device importance

Broader Implications: Consumer Networking Trust

This vulnerability sits in a disturbing pattern across the budget consumer networking market. The comparison below summarizes vendor response patterns to similar disclosures:

Tenda's silence on CVE-2026-11405 mirrors the response pattern seen with shared-OEM firmware bugs (the 2015 ZTE XXXXairocon incident affected ASUS, D-Link, DIGICOM, Observa, and PLDT routers simultaneously — none of them patched because the credential was embedded at the OEM chipset level).

What this means for homelab operators:

• The cheapest consumer router is not always the safest. Budget devices from manufacturers with no disclosure track record carry hidden trust assumptions that are violated when vendors embed undocumented access paths in firmware.
• ISP-provided equipment (often budget Tenda or ZTE-OEM) may ship with factory credentials baked into hardware you never fully control. Always audit what your ISP ships to your home.
• "Change default password" does not apply here — this is not a default credential issue; it is a hidden second authentication path that exists regardless of what password the administrator sets.

Timeline

Unverified / Uncertain Items

• Actual value of sys.rzadmin.password: Not publicly disclosed by CERT/CC. Would require firmware extraction and reverse engineering to recover — a legitimate research step that homelab operators should NOT attempt themselves on production devices.
• Full scope of affected models: CERT/CC explicitly states the official list is not exhaustive. The shared httpd binary strongly suggests additional Tenda models are vulnerable but unreported.
• Whether this backdoor is intentional or accidental: Multiple indicators point to deliberate embedding (CWE-912 classification, vendor silence, rzadmin naming convention matching known OEM patterns), but CERT/CC does not formally attribute intent.

Sources

1. CERT/CC VU#213560 — "Tenda firmware (multiple versions) contains hidden authentication backdoor" (Primary): https://kb.cert.org/vuls/id/213560
2. NVD CVE-2026-11405 entry (Primary): https://nvd.nist.gov/vuln/detail/CVE-2026-11405
3. SOCFortress Medium — reverse engineering analysis of backdoor mechanics (Secondary): socfortress.medium.com/unpatched-backdoor-in-tenda-router-firmware-cve-2026-11405-b2dace8ef73b
4. PT Security dbugs — CVSS 10 confirmation, "real-world incidents" reference (Secondary): dbugs.ptsecurity.com/vulnerability/CVE-2026-11405
5. Gridinsoft Blog — consumer guidance for affected users (Secondary): blog.gridinsoft.com/tenda-router-backdoor-cve-2026-11405
6. TechTimes — investigative reporting on vendor patterns and historical context (Secondary): www.techtimes.com/articles/319872/20260707/tenda-firmware-backdoor
7. Censys Advisory for CVE-2025-1851 — 14,049 exposed Tenda Router web login interfaces (March 2025) (Primary): https://censys.com/advisory/cve-2025-1851
8. Shodan public search: "tenda router" — 534 results (July 27, 2026) (Primary): shodan.io

Related articles on malwlab.se:

• SharePoint Critical RCEs Advisory (CVE-2026-45659/56164)
• SharePoint ToolShell CVE-2025-53770 Advisory
• Homelab Reverse Proxy Attack Analysis

Action Summary for Homelab Operators

IF your router model appears in the affected list above:

IMMEDIATELY:Disable remote managementRestrict admin access to local LAN only

THIS WEEK:Audit network topology — identify all devices routing through this routerCreate replacement procurement plan (budget $50–200 for replacement)

RATHER SOON:Replace with a responsive-vendor product or purpose-built homelab firewallSegment IoT/deprecated devices behind the new gateway

IF you cannot replace immediately:Monitor network traffic for anomalous DNS queriesCheck for unexpected device connections on your LANLog into admin interface periodically and verify no unknown port forwards exist

End of advisory.
Compiled from CERT/CC VU#213560, Censys exposure data, PT Security intelligence, Shodan surface analysis, and vendor response pattern research. All factual claims sourced above.