EUVD-2026-41919
GHSA-w55r-jjxw-gxrx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable web login with an unconditional backdoor branch granting full admin (role=2) and total device control; PR:N assumes a known/shared backdoor secret, otherwise PR could rise if per-device.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8.
- The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key).
- After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configuration.
- It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password.
A successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked - any username works with the backdoor
AnalysisAI
Authentication bypass in Tenda router firmware (AC10, AC5, AC6, FH1201, W15E) lets any user log in as administrator via a hidden vendor backdoor: after normal MD5-based login fails, the /bin/httpd login() routine at 0x4c88b8 falls back to a plaintext strcmp() against the 'sys.rzadmin.password' config value, granting role=2 (admin) with any username. Reported through CERT/CC (VU#213560), it is not in CISA KEV and has no public exploit identified at time of analysis, with a low EPSS score of 0.24% (15th percentile). The flaw is a classic CWE-912 hidden-functionality backdoor mapped to CVSS 9.8.
Technical ContextAI
The affected component is the embedded web management server (/bin/httpd) shipped in Tenda SOHO router firmware images built on the Realtek/Tenda platform (versions such as US_AC10V1.0re_V15.03.06.46, US_AC6V2.0RTL_V15.03.06.51, US_AC5V1.0RTL_V15.03.06.48, US_FH1201V1.0BR_V1.2.0.14(408), and US_W15EV1.0br_V15.11.0.5). The legitimate authentication path uses hashed verification through prod_encode64, PasswordToMd5, and check_rand_key. The root cause is intentional hidden functionality (CWE-912, referenced directly in the advisory even though NVD lists CWE as N/A): a secondary code branch reads a backdoor credential via GetValue("sys.rzadmin.password") and compares it to the supplied password with a direct plaintext strcmp() rather than a hashed comparison. A match unconditionally assigns admin role=2 and mints a valid session, and the 'rzadmin' username itself is never validated, so the backdoor works with any username field.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available data at time of analysis; monitor the CERT/CC advisory (https://kb.cert.org/vuls/id/213560) and Tenda for updated firmware for the AC10, AC5, AC6, FH1201, and W15E lines. As compensating controls, do not expose the router web management interface (HTTP/HTTPS admin) to the WAN/internet - disable remote management so /bin/httpd is only reachable from the LAN, which prevents unauthenticated internet-based abuse of the backdoor at the cost of losing remote administration. Restrict LAN access to the management interface via ACLs/management VLAN to trusted admin hosts only, and where feasible clear or overwrite the sys.rzadmin.password configuration value to break the strcmp() match (verify this does not disrupt legitimate function, as its full purpose is undocumented). For high-risk deployments, consider replacing affected end-of-support consumer hardware, since embedded backdoors in shipped binaries cannot be reliably removed without a vendor firmware fix.
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a d
Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043ND_V1_12
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows r
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows r
Multiple cross-site request forgery (CSRF) vulnerabilities in Compal Broadband Networks (CBN) CH6640E and CG6640E Wirele
Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 wit
Poisoned-pipeline (pwn request) code execution in the Meshtastic firmware repository's GitHub Actions CI allows any exte
Anonymous MQTT access in Yarbo firmware v2.3.9 allows remote unauthenticated attackers on the local network to fully con
Hardcoded administrative credentials in Yarbo firmware v2.3.9 allow remote unauthenticated attackers to gain full device
Denial of service in Meshtastic firmware prior to 2.7.23.b246bcd allows a single node whose User.long_name contains malf
Undocumented persistent backdoor in Yarbo firmware v2.3.9 grants remote privileged access that survives factory reset an
The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboa
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today