The CERT Coordination Center published Vulnerability Note VU#213560 on July 6, disclosing a hardcoded authentication backdoor in several Tenda router firmware builds, tracked as CVE-2026-11405. The flaw sits in the login function of the device’s /bin/httpd web server: when normal MD5-based password verification fails, the code falls back to comparing the submitted password against an alternate value in plaintext, without checking the username at all. Any username paired with that backdoor password succeeds. Affected builds span multiple Tenda models, including FH1201, W15E, AC10, AC5, and AC6 firmware lines. CERT/CC says it notified Tenda on May 19 and, as of publication, “has not received a statement from the vendor.” No patch is available.
For SOC teams, the practical exposure is narrower than the headline backdoor suggests but still real: it requires network access to a device’s web management interface, so the routers most at risk are the ones with remote management left enabled, a common default in small-office and branch deployments that IT rarely audits directly. CERT/CC’s own guidance is to disable remote web management, since there is no firmware fix to apply.
The pattern here is the more durable story. This is now the second unpatched or slow-to-patch network edge device CyberTech has tracked in recent weeks, alongside a Lantronix serial device flaw CISA flagged as actively exploited. Consumer and SMB-grade network hardware sits at the edge of a growing number of hybrid and branch-office environments, gets far less vendor security investment than enterprise firewalls, and, as this case shows, can sit unpatched indefinitely once a vendor goes quiet. Security teams that inventory only enterprise-grade network gear are leaving a widening blind spot at exactly the layer attackers use for initial access and persistence.
Source: CERT/CC
