{"id":"CVE-2026-11405","aliases":["EUVD-2026-41919","GHSA-w55r-jjxw-gxrx"],"status":"published","title":"Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface","description":"The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8.\r\n\r\n- The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key).\r\n- After normal authentication fails, it calls GetValue(\"sys.rzadmin.password\") to read a backdoor password from the device configuration.\r\n- It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password.\r\n\r\nA successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00765,"percentile":0.55762,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2026-07-06T19:17:07Z","modified":"2026-10-25T20:10:00Z","exploits":[{"source":"pocgithub","id":"HORKimhab/CVE-2026-11405","title":"HORKimhab/CVE-2026-11405","date":"2026-07-07","url":"https://github.com/HORKimhab/CVE-2026-11405"}],"products":[{"vendor":"tenda","product":"firmware"},{"vendor":"yarbo","product":"firmware"}],"references":[{"url":"https://cwe.mitre.org/data/definitions/912.html"},{"url":"https://kb.cert.org/vuls/id/213560"},{"url":"https://www.kb.cert.org/vuls/id/213560"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11405"},{"url":"https://github.com/advisories/GHSA-w55r-jjxw-gxrx"}],"sources":{"cve":[{"id":"CVE-2026-11405","title":"Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface","description":"The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8.\r\n\r\n- The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key).\r\n- After normal authentication fails, it calls GetValue(\"sys.rzadmin.password\") to read a backdoor password from the device configuration.\r\n- It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password.\r\n\r\nA successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor","status":"published","published":"2026-07-06T19:17:07.891Z","modified":"2026-07-08T13:40:24.471Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:20:04.809935Z"}],"euvd":[{"id":"EUVD-2026-41919","description":"The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8.\r\n\r\n- The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key).\r\n- After normal authentication fails, it calls GetValue(\"sys.rzadmin.password\") to read a backdoor password from the device configuration.\r\n- It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password.\r\n\r\nA successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor","status":"published","published":"2026-07-06T19:17:07Z","modified":"2026-07-08T13:40:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:11.058935Z"}],"ghsa":[{"id":"GHSA-w55r-jjxw-gxrx","title":"The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login...","description":"The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8.\n\n- The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key).\n- After normal authentication fails, it calls GetValue(\"sys.rzadmin.password\") to read a backdoor password from the device configuration.\n- It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password.\n\nA successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor","status":"published","published":"2026-07-06T21:30:39Z","modified":"2026-07-08T15:32:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:09:20.268554Z"}],"nvd":[{"id":"CVE-2026-11405","description":"The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8.\r\n\r\n- The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key).\r\n- After normal authentication fails, it calls GetValue(\"sys.rzadmin.password\") to read a backdoor password from the device configuration.\r\n- It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password.\r\n\r\nA successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor","status":"published","published":"2026-07-06T20:16:29.45Z","modified":"2026-10-25T20:10:00.147Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:28.040501Z"}]}}