Tenda router firmware undocumented authentication backdoor
Multiple Tenda consumer router firmware builds ship an undocumented authentication backdoor in the web management binary. When normal password verification fails, an alternate code path consults a hidden credential and grants full admin access. CERT/CC coordinated disclosure Monday, 2026-07-06. Reporter anonymous. Tenda did not respond; no patch is available.
- Vendor
- Tenda
- Product
- FH1201, W15E, AC10, AC5, AC6 V2 (multiple firmware builds — see article)
- CVSS
- N/A
- EPSS (exploit probability)
- 0.8%
- Status
- unpatched
- Published
Is CVE-2026-11405 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-11405 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.8% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-11405 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-11405 is an undocumented authentication backdoor in the /bin/httpd web management binary shipped with several Tenda consumer router firmware builds. Per CERT/CC’s advisory, when the normal password verification path fails, an alternate path consults a separate configuration credential; a match on that credential grants full administrator-role access to the router’s web management interface, regardless of the credentials configured for the actual admin account.
Severity note
Neither NVD nor CERT/CC has published a numeric CVSS score for this record as of publication. This site’s badge follows CERT/CC’s characterization — an unauthenticated bypass to full administrative control — as high while a canonical CVSS is outstanding. The reachability of the backdoor depends on whether the router’s web management interface is exposed to the network path from which an attacker would need to reach it (LAN by default; WAN if remote management is on), which is why NVD’s future scoring may land anywhere from the high single-digits into the low-9s.
Affected firmware (per CERT/CC coordinated disclosure)
- Tenda FH1201, firmware V1.2.0.14
- Tenda W15E, firmware V15.11.0.5
- Tenda AC10, AC5, and AC6 V2, multiple firmware builds documented in the advisory
Owners of other Tenda models should treat “silence” as “unknown” until CERT/CC or Tenda scopes further — Tenda has not responded to CERT/CC’s coordinated disclosure.
Patch status
None. CERT/CC reports Tenda could not be reached for remediation. There is no vendor patch, no firmware update, and no published timeline for one. The published mitigations are host-hardening steps only:
- Disable remote (WAN-side) web management on affected devices.
- Change the router’s default LAN IP address away from the factory default to reduce automated-scanner discoverability on internal networks where an attacker has already landed.
- Where feasible, isolate the router off networks that carry sensitive traffic or serve as a jump-off to other assets.
For a full breakdown of the practical response, see the accompanying article: Tenda Router Backdoor Has No Patch. Here’s What to Do..
Sources
- CERT Coordination Center advisory, via The Hacker News writeup, 2026-07-07.
- BleepingComputer, 2026-07-07.
- NVD entry for CVE-2026-11405.
Other Tenda CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2021-31755 Tenda AC11 Router Stack Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 86.5% | |
| CVE-2020-10987 Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 79.8% | |
| CVE-2018-14558 Tenda AC7, AC9, and AC10 Routers Command Injection Vulnerability | [ CRITICAL ] | 9.8 | 8.5% |
