A Plaintext Backdoor in Tenda Routers Is About to Feed the Next Botnet Wave

A Chinese router vendor shipped firmware that quietly compares your login attempt against a plaintext password stored in a config value — and if it matches, hands over admin access regardless of what username you typed. That’s not a bug. That’s a backdoor, and CERT/CC just published it with no patch in sight because the vendor won’t pick up the phone.

The vulnerability, tracked as CVE-2026-11405, affects at least five Tenda router models and behaves exactly the way defenders fear: a hidden authentication path in /bin/httpd that bypasses the documented MD5-based login and grants role=2 (administrator) to anyone who knows the secret. According to the CERT Coordination Center bulletin, the mechanism is undocumented, invisible in the admin UI, and unfixed. If your home lab, branch office, or small-business network sits behind one of these boxes, you’re the mitigation.

How the Backdoor Actually Works

CERT/CC describes a two-stage login() function inside the httpd binary. The first stage runs a standard MD5 credential check. If that fails, the firmware falls through to a second check: it reads the sys.rzadmin.password value from the device configuration and does a direct plaintext comparison against whatever the remote user supplied. Match the string, get a valid session — the username field is ignored entirely.

This matters because it inverts every assumption a defender makes about router authentication. Rate-limiting attempts against a known admin username does nothing when the username is irrelevant. Rotating the admin password does nothing when the backdoor password lives in a separate config key most users have never heard of. And per CERT/CC, exploitation gives an attacker full control to “reconfigure the device, alter network settings, and disable security features” — the classic pivot into the rest of the LAN.

If you’re an IT lead at a small clinic running one of these Tenda units as a branch gateway, you don’t just have a vulnerable router. You have a device that can be silently reconfigured to reroute DNS, disable firewall rules, or plant a persistent foothold in front of every endpoint on the network — which is exactly the kind of exposure that makes downstream healthcare compliance workloads a nightmare to defend. Expect this CVE to appear in Mirai variant target lists within weeks.

Why an Unreachable Vendor Is the Real Story

CERT/CC’s bulletin is explicit: the issue is unfixed because Tenda “couldn’t be reached.” That single sentence is more damaging than the CVE itself. A coordinated disclosure model assumes there’s a vendor on the other end of the email. When there isn’t, defenders get the vulnerability details but no remediation path — and attackers get a public roadmap.

Cheap consumer networking hardware has a structural problem. The devices ship, the margins are thin, the security team is either tiny or nonexistent, and firmware support windows are unofficial at best. For a procurement team, the takeaway is that the total cost of a $40 router isn’t $40 — it’s $40 plus the cost of ripping it out when the vendor goes dark. That calculus should be part of every hardware selection decision, especially for edge devices sitting in retail locations, warehouses, or remote sites where physical replacement is expensive.

If you’re building auditable systems — think a traceable supply chain deployment with sensors and gateways scattered across facilities — an unreachable vendor in your BOM is a compliance time bomb. Within the next 12 months, expect at least one major enterprise breach post-mortem to name Tenda or a similar low-cost vendor as the initial access vector, and expect procurement guidance from CISA or ENISA to start explicitly flagging vendors with no coordinated disclosure track record.

What Defenders Should Actually Do This Week

CERT/CC’s mitigation guidance is blunt and correct: disable the remote web management panel so the vulnerable interface isn’t reachable from the internet, and change the default LAN IP address to make opportunistic scanning harder. Neither fixes the backdoor. Both raise the cost of exploitation enough to matter until you can replace the device.

In practice: if you’re running a Tenda AC10, AC5, AC6 V2, W15E, or FH1201 — the five models named in the bulletin — treat the device as compromised-until-proven-otherwise. Pull it off any WAN-exposed management path, segment it to a VLAN that can’t reach sensitive assets, and start a hardware replacement ticket. If you’re a managed service provider with these devices in client fleets, this is a customer-notification event, not a maintenance window item.

The broader take: home and SMB routers are the softest layer of most networks, and they’re increasingly where nation-state and criminal actors are staging infrastructure. This won’t be the last undocumented authentication path found in a consumer router this year. Build your incident response playbooks around that assumption.

FAQ

Q: What is CVE-2026-11405? A: It’s a hidden authentication backdoor in the login function of the /bin/httpd web server binary used by multiple Tenda router firmware versions. When standard MD5 authentication fails, the firmware falls back to comparing the submitted password against a plaintext value stored in sys.rzadmin.password — and any username is accepted as long as that password matches, granting full admin access.

Q: Which Tenda devices are affected? A: According to CERT/CC, the affected firmware versions cover the Tenda FH1201, W15E, AC10, AC5, and AC6 V2 WiFi routers. Specific firmware build strings are listed in the CERT/CC bulletin (VU#213560). No patch is currently available because Tenda has not responded to disclosure attempts.

Q: Is this being actively exploited? A: There’s no confirmed active exploitation reported at the time of the CERT/CC disclosure. However, router-focused botnets like Mirai variants routinely absorb newly published CVEs within days or weeks, so the practical assumption should be that opportunistic scanning will begin quickly.

Key Takeaways

• Treat any Tenda AC10, AC5, AC6 V2, W15E, or FH1201 on the affected firmware as compromised-until-proven-otherwise, and prioritize hardware replacement rather than waiting for a patch that may never ship.
• Add “vendor responsiveness to coordinated disclosure” as an explicit criterion in your network hardware procurement checklist — an unreachable vendor is a supply chain risk, not just a support inconvenience.
• Disable remote web management on all consumer-grade routers by default; the Tenda backdoor is only the latest reminder that WAN-exposed admin interfaces are the single highest-value target on the edge.
• Expect at least one Mirai-style botnet variant to weaponize CVE-2026-11405 within the coming months, and pre-stage detection rules for unusual outbound traffic from segments that terminate on these devices.
• Auditors and compliance teams should start asking whether edge networking devices have an active security response contact — the absence of one is now a documentable finding.