CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware

CERT/CC warns that several Tenda router firmware versions contain an undocumented authentication backdoor (CVE-2026-11405) in the /bin/httpd login() function that, when a specific configuration-stored plaintext password is supplied, bypasses password verification and grants administrative (role=2) web-interface access for any username; the issue is unpatched and users are advised to disable remote management and change default LAN IPs to reduce exposure.