Beware of Backdoor in Tenda Routers: CVE-2026-11405 Flaw and How to Protect Your Network

Beware of Backdoor in Tenda Routers: CVE-2026-11405 Flaw and How to Protect Your Network

A surprising discovery comes from network devices widely used in homes and small offices. Security researchers have uncovered a hidden backdoor in the firmware of several Tenda routers. This flaw, registered as CVE-2026-11405, allows attackers to take full control of the device with just a simple trick.

Hidden Backdoor Found in Tenda Router Firmware

Poor software security practices have backfired again. In the login function of Tenda routers, a secret, undocumented authentication mechanism is embedded. In other words, there is a “backdoor” that was either intentionally or unintentionally created by the developers.

This mechanism allows the login process to be verified through two paths: the normal path using administrator credentials, and a secret path that compares a hard-coded string (a permanent factory default password). Because the string is embedded in the firmware and is the same for all affected devices, anyone who knows it can log in without needing to know the user's actual password.

Confirmed affected models include, but are not limited to:

• Tenda AC10
• Tenda AC15
• Tenda AC18
• Several AC9 and N series models with outdated firmware versions.

How the CVE-2026-11405 Vulnerability Works

Technically, the login function in these routers performs dual verification. First, it accepts the username and password from the user. Second, in parallel, it compares the submitted password with a certain hard-coded string stored in memory. If the password matches that secret string, authentication is immediately considered successful—regardless of whether the username is valid or even if the username is left blank.

This is the core of the bypass: an attacker simply sends a login request with any username (or left blank) and the password as that secret string. The system will skip the entire normal verification process and grant full administrator access. No complex engineering is needed, just a specially crafted HTTP request.

Impact of Backdoor Exploitation on Users

The impact is very serious because the router is the main gateway for data traffic on the network. With full administrator access, an attacker can:

• Change DNS settings to redirect victims to fake credential-stealing sites.
• Open ports and forward traffic to malicious servers (port forwarding).
• Intercept local network communications.
• Lock out legitimate users from the device by changing the original password.

On a broader scale, infected devices can be made part of a botnet. Hijacked routers can be used to launch DDoS attacks, spread malware to other devices on the network, or serve as dark proxies for illegal activities. Given that many users rarely check or update router firmware, the potential for spread is very high.

Mitigation Steps While Waiting for a Patch from Tenda

As of this writing, Tenda has not released an official patch for all affected models. While waiting for updates, protect your network with the following steps that can be directly applied through the router's web interface.

1. Disable Remote Web Management

This feature allows access to the admin panel from the internet. Turn it off immediately to prevent the flaw from being exploited externally.

• Access the router via the local IP address (default: 192.168.0.1 or 192.168.1.1).
• Go to the System Settings → Remote Management menu.
• Uncheck the Enable or Allow Remote Access option.
• Save settings.

You can also block access from the WAN interface with additional firewall rules if the router supports it. Example commands via Telnet/SSH (if enabled):

iptables -I INPUT -p tcp --dport 80 -i ppp0 -j DROP
iptables -I INPUT -p tcp --dport 443 -i ppp0 -j DROP

2. Change the Default LAN IP Address

Mass attacks often target standard default gateways. By changing the router's IP address, you reduce the risk of automated scanning.

• Go to the Network → LAN Settings menu.
• Change the IP Address from 192.168.0.1 to a less common subnet, for example 192.168.87.254.
• Save, the router will restart. Make sure you remember the new address.

Other equally important steps:

• Ensure the router's firewall is active.
• If possible, place the router behind an additional security device or use separate network segments for critical devices.
• Regularly monitor official Tenda announcements regarding the availability of patched firmware.

This vulnerability is a reminder that network hardware also needs attention just like computers or phones. Until the manufacturer acts, vigilance and self-mitigation are our best defense.

This article was written by artificial intelligence (AI) using the deepseek-v4-pro model via SumoPod AI.

This article was translated by Artificial Intelligence (AI) using deepseek-v4-pro via SumoPod AI.