Tenda's Router Firmware Checks Your Password. If It's Wrong, It Checks a Second, Hidden One. That's Not a Bug — It's a Decision.
- Patrick Duggan
- Jul 13
- 5 min read
Updated: Aug 11
Let us be clear about what CVE-2026-11405 is, because the word "vulnerability" is doing a lot of quiet work to make it sound like an accident. CERT/CC disclosed it on July 6 as VU#213560, and the mechanism is not a buffer overflow, not a missing bounds check, not a mistake a tired developer makes at 2 a.m. It is a second password. It was put there on purpose. And the routers it lives in are sitting in hundreds of thousands of homes and small offices, unpatched, because the vendor has not responded.
What the firmware actually does
Here is the login logic, in plain English, from the login() function in the /bin/httpd web server binary. You send a username and password. The firmware does the normal thing first: it runs a standard MD5-based check against your real credentials. If that passes, fine, you are in. But if it fails — if you type the wrong password — the firmware does not stop there. It reaches for a second value stored in the configuration under the name sys.rzadmin.password, compares your input directly against that plaintext string, and if it matches, it hands you administrator access, role level 2, and mints you a valid session.
Read that again. The failure path of the password check is not "deny." The failure path is "try the other password." A device whose entire job is to be the front door of a network ships with a second key cut at the factory, filed under a name — rzadmin — that reads exactly like the vendor's own remote-admin account. There is no interpretation of that which is an accident. Somebody wrote that fallback, gave it a config key, and shipped it.
Why a hidden password is worse than a normal bug
Most of the router flaws we track are bugs: a command injection, a stack overflow, a path traversal. They are bad, but they are mistakes, and a mistake gets patched when someone notices. A backdoor is different in kind. It does not get "fixed" by a bounds check — it gets fixed by the vendor admitting the account exists and removing it, which requires the vendor to care. As of this writing Tenda has not responded to CERT/CC at all, there is no firmware update, and the affected models — the FH1201, the W15E, the AC10, and per the advisory the AC5 and AC6 — are simply exposed with no vendor path to safety. This is a zero-day in the truest sense: known, unpatched, and abandoned by the party who could close it.
And the blast radius from the front door of a network is total. An attacker with admin on your router does not need anything else. They redirect every DNS query on the network to a server they control, so every site you visit can be silently swapped. They turn the firewall off and expose every device behind it directly to the internet. They add port-forwards that tunnel outside traffic straight into your LAN. Your laptop, your NAS, your cameras, your work VPN endpoint — all of it is now downstream of a box that answers to a password you were never told about.
This is a pattern, and Tenda is a repeat name on it
We keep every entry in CISA's Known Exploited Vulnerabilities catalog cross-referenced, and cheap consumer routers are one of its most durable neighborhoods. Tenda alone is already a repeat offender: the AC7, AC9, and AC10 command-injection flaw (CVE-2018-14558), the AC15 remote code execution (CVE-2020-10987), the AC11 stack overflow (CVE-2021-31755). CVE-2026-11405 is the same vendor's name on the list again, and this time it is not a slipped bounds check — it is an intentional-looking backdoor. Widen the lens and the whole SOHO-router aisle is a graveyard: D-Link across half a dozen models, NETGEAR, Zyxel, TP-Link, DrayTek, Dasan's GPON auth-bypass, the Realtek SDK that ships inside dozens of other brands. The device class that sits at the edge of the most networks, gets patched the least, and is monitored by no one is the same device class that keeps turning up with hardcoded credentials and hidden accounts.
That is the honest frame here, and we will keep it honest: this is CERT/CC's finding, not ours. We did not discover CVE-2026-11405 and we are not going to dress up a catalog cross-reference as a prediction. What we can tell you is where it sits in the pattern — a chronically-soft vendor, in a chronically-soft product class, with the worst flavor of flaw — and that the pattern says the next one is already in someone's firmware, waiting for a researcher with a disassembler.
What to actually do
If you run one of the affected Tenda models, assume it is compromisable today, because there is no patch coming on the vendor's current trajectory. Disable remote web management immediately — that alone takes the attack off the public internet and reduces it to someone already on your LAN. Change the router's default LAN IP address so automated scanners that hunt the usual 192.168.0.1 and 192.168.1.1 addresses do not find it as easily. Check the DNS servers your router is handing out to make sure they are yours and not a stranger's, and review the port-forwarding table for entries you did not create. And then, honestly, plan to replace the hardware, because a vendor that ships a hidden admin password and does not answer CERT/CC has told you everything you need to know about whether the next firmware will be any different.
We hold this at 95 percent as always. There is no confirmed in-the-wild exploitation yet and no public proof-of-concept, and we say so plainly rather than inflating a real risk into a fake emergency. But a hidden password in the login path of an internet-facing router is not a risk that ages well, and the window between "CERT/CC published the mechanism" and "someone weaponizes it" is exactly the window this whole industry keeps losing. The bug you can patch is a nuisance. The password somebody built on purpose, in a product the vendor has stopped answering for, is the one you replace the box over.
Sources: CERT/CC Vulnerability Note VU#213560 (July 6, 2026) and CVE-2026-11405; CISA Known Exploited Vulnerabilities catalog, Tenda entries queried directly.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=tenda-s-router-firmware-checks-your-password-if-it-s-wrong-it-checks-a-second-hidden-one-that-s
Comments