Tenda Routers CVE-2026-11405

Exploitation requires network reachability to the /bin/httpd web management interface and knowledge of the backdoor credential stored in sys.rzadmin.password; the attacker submits that value as the password with ANY username (the 'rzadmin' username is never checked) and the normal MD5 authentication must fail first so the code reaches the backdoor branch. The decisive limiting factor is whether the rzadmin password is a fixed vendor-wide constant (making this a universal remote backdoor) or a device-specific value - the description does not state which, and this determines real exploitability. Further limiting factors: the management interface must be reachable by the attacker (default consumer deployment exposes it to the LAN, and only to the WAN if remote management is enabled), and only the listed Tenda firmware builds are confirmed affected.

The signals here conflict and warrant nuance. CVSS 3.1 rates this 9.8 with AV:N/AC:L/PR:N/UI:N (network, low complexity, no privileges), and SSVC marks Technical Impact as 'total' and Automatable as 'yes' - consistent with full admin takeover. However, SSVC Exploitation is 'none' (not in CISA KEV), EPSS is only 0.24% at the 15th percentile, and no POC is referenced, indicating no observed real-world exploitation yet. The critical caveat: the PR:N rating assumes the attacker can supply the correct backdoor secret, but the value is read from device configuration (sys.rzadmin.password), so exploitability hinges on whether that password is a fixed/known vendor constant (true universal backdoor, justifying 9.8) or a per-device value an attacker cannot easily obtain - the available data does not confirm which. If the credential is a shared hardcoded value, this is a high-priority remotely exploitable backdoor on internet-exposed router management interfaces; if it is device-unique and non-default, real-world risk is materially lower than the 9.8 implies. Verify the nature of the rzadmin password with CERT/CC VU#213560.

An attacker who can reach the router's web login (for example, a device with remote management exposed to the internet, or an attacker on the local network) submits any username with the backdoor password value in the login form. Because the login() routine falls through to a plaintext strcmp() against sys.rzadmin.password after the normal hash check fails, a correct value immediately returns an admin (role=2) session, giving full device control. No public exploit code is referenced, but the attack is trivially automatable (SSVC Automatable: yes) once the backdoor password is known.