Tenda Router Firmware Contains Hidden Admin Backdoor

Multiple firmware versions released by Chinese network device manufacturer Tenda have been found to contain an undocumented authentication backdoor, the CERT Coordination Center (CERT/CC) announced on Monday. This vulnerability, tracked as CVE-2026-11405, allows an attacker to bypass password verification and gain administrative access to the devices' web management interfaces. The CERT/CC has not yet disclosed the specific firmware versions affected by this backdoor, nor has Tenda issued a public statement regarding the discovery or a plan for remediation.

The CERT/CC's advisory highlights the critical nature of such vulnerabilities, as they can be exploited by malicious actors to compromise network security. Administrative access to a router allows an attacker to reconfigure network settings, redirect traffic, intercept user data, or use the device as a pivot point for further attacks within a network. The lack of documentation for this backdoor suggests it may have been intentionally embedded, though the purpose remains unclear without further investigation or disclosure from Tenda.

This discovery underscores the ongoing challenges in securing Internet of Things (IoT) devices and network infrastructure. Manufacturers are often under pressure to release products quickly, which can sometimes lead to security oversights or the inclusion of features that pose risks. Users of Tenda routers are advised to remain vigilant for any official security advisories from the manufacturer or CERT/CC regarding patches or mitigation strategies. Without immediate action from Tenda, users may be at risk of unauthorized access to their home or business networks.