CVE-2026-11405 Auth bypass in firmware
A hidden backdoor in Tenda firmware allows attackers to gain admin access to the web interface using a hardcoded password, bypassing normal authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11405?
CVE-2026-11405 is a critical authentication bypass vulnerability in Tenda firmware, published on 6 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8. - The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key). - After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configuration. - It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password. A successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor
Which versions are affected by CVE-2026-11405?
How do I fix CVE-2026-11405?
No fix has been published for CVE-2026-11405 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-11405 being exploited?
There is no known exploitation of CVE-2026-11405 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-w55r-jjxw-gxrx.