LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
cve recordcritical

CVE-2026-11405

Published
CVSS9.8
Severitycritical
Weakness—
ExploitedNot in CISA KEV

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8. - The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key). - After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configuration. - It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password. A successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor

References

← Back to the CVE Tracker

Our coverage of CVE-2026-11405

CVE-2026-11405critical

Tenda Firmware Vulnerability Allows Unauthenticated Admin Access

A critical vulnerability has been identified in the firmware of Tenda devices, allowing attackers to gain administrative access without authentication. The flaw, tracked as CVE-2026-11405, affects the web management interface of the affected devices.

CVE-2026-11405high

CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware

A significant security vulnerability has been discovered in the firmware of several Tenda router models, potentially exposing users to unauthorized administrative access. The CERT Coordination Center (CERT/CC) has issued a warning about this hidden backdoor, which allows attackers to bypass normal authentication procedures and gain control over the router's web interface.