CERT Warns of Unpatched Tenda Firmware Backdoor Allowing Admin Access

CERT/CC disclosed two unpatched security issues: CVE-2026-11405, an undocumented backdoor in multiple Tenda networking devices allowing attackers who know the configured backdoor password to bypass authentication and gain administrative access; and CVE-2026-13753, a missing authorization flaw in HP DeskJet 2800 series printers that returns sensitive administrative and Wi‑Fi credentials via unauthenticated API endpoints. CERT advises immediate mitigations (disable remote web management, change default LAN IP) while no patches are available.