The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login

CVE-2026-11405 is a hidden authentication backdoor baked into /bin/httpd on five Tenda consumer/SOHO router firmware builds: US_AC6V2.0RTL_V15.03.06.51_multi_T, US_AC5V1.0RTL_V15.03.06.48_multi_TDE01, US_AC10V1.0re_V15.03.06.46_multi_TDE01, US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE, and US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD. Inside the login() function at offset 004c88b8, after the normal MD5 password check fails, the binary falls through to GetValue("sys.rzadmin.password") and does a strcmp() against the submitted password. Any match grants role=2 — full admin — and hands back a valid session cookie against the web management UI.

There is no vendor CVSS because CERT/CC could not reach Tenda for coordination — the advisory (VU#213560) shipped uncoordinated on 2026-07-06 with no patch available. In a home use case this would rate around a 7; in an enterprise context where a Tenda unit is fronting a branch office, a lab, or a remote worker VPN concentrator, it's a full gateway takeover with no fix path. That combination — pre-auth admin, no patch, orphaned vendor, network-edge role — pushes this out of the CVSS-arithmetic zone and into 'if you find one, treat it like it's already owned'.

Why this verdict

• Pre-auth admin, single request — no user interaction, no chained bug, no memory-corruption reliability tax. Once the endpoint is reachable, exploitation is a curl POST.
• No vendor patch and no vendor contact — this is not a 'patch by X date' problem; it's a rip-and-replace problem. That elevates the mitigation-side severity independent of CVSS math.
• Role multiplier: network edge appliance — per the noisgate high-value role catalog, a router is a gateway. Chain outcome on a branch-office or remote-worker deployment is DNS hijack, port-forward-driven internal access, and VPN-server abuse for LAN pivot. This sets the floor at HIGH.
• Friction adjustment down from CRITICAL — Tenda is consumer/SOHO gear rarely present in an enterprise 10k-host fleet; WAN-side management is off by default on most builds; the five listed firmware strings are narrow. That narrows the reachable population enough to sit below CRITICAL but not below HIGH.
• No KEV, no public PoC yet — keeps this below the 'patch immediately, hours' bar reserved for actively-exploited edge bugs, but the disassembly-in-advisory pattern makes weaponization a matter of days.

Why not higher?

CRITICAL is reserved for vulns where the canonical deployment role of the component is high-value AND the reachable population is broad. Tenda SOHO routers occupy the network-edge role opportunistically inside enterprises (shadow IT, branch offices, home workers) rather than by definition, and WAN-facing admin is not the default posture. Without an active KEV listing or observed campaigns, CRITICAL over-cries.

Why not lower?

MEDIUM would ignore the role multiplier: when one of these devices IS in your environment, the outcome is gateway takeover with no vendor fix — that is not a MEDIUM outcome. The absence of a CVSS baseline and the presence of an intentional vendor backdoor (CWE-912) with no coordination path means treating this as backlog hygiene would be malpractice.

1. Inventory for Tenda hardware across the fleet within 7 days — Run runZero / Defender EASM / Nmap fingerprint sweeps for the Tenda httpd banner and login-page HTML across every corp subnet, branch office, and remote-worker VPN pool. You cannot mitigate what you have not found. Deploy within the 30-day noisgate mitigation window; start day one.
2. Disable WAN-side (remote) management on any Tenda unit found — In the router UI: System Tools → Remote Web Management → Disable. This removes the internet-reachable attack surface immediately and buys time while you plan replacement. Do within 30 days of inventory hit.
3. ACL the management interface to a dedicated admin VLAN — On the upstream switch/firewall, restrict TCP/80 and TCP/443 to the router's LAN IP to a single jump-host subnet. Blocks LAN-adjacent attackers (rogue guest Wi-Fi, compromised endpoints) from reaching the backdoor.
4. Replace with a supported model on a 90-day schedule — Vendor is unreachable; no patch is coming. Any HIGH device without a remediation path must be swapped out. Target UniFi, MikroTik, Meraki, or an enterprise-supported alternative within the 180-day noisgate remediation window — sooner if the unit is WAN-management-exposed.
5. Ship router syslog to your SIEM and alert on admin logins — Enable System Log → Remote Syslog on the Tenda, point at a rsyslog collector, and alert on any admin login not sourced from your admin VLAN. Detective control until replacement lands.
6. Force DoH/DoT on endpoints behind Tenda units — Endpoint-enforced encrypted DNS (Cloudflare/Quad9/internal DoH resolver via MDM) neutralizes the router-side DNS-hijack payoff even if the router is owned.

Run from an auditor workstation on the same network segment as the router (or with routed reachability to its management IP). Invoke as ./check-cve-2026-11405.sh 192.168.0.1 — no privileges required. Fingerprints the login page against the five known-vulnerable Tenda firmware strings.

#!/usr/bin/env bash
# noisgate check for CVE-2026-11405 — Tenda /bin/httpd hidden backdoor
# Usage: ./check-cve-2026-11405.sh <router-ip-or-host> [port]
# Exit codes: 0 VULNERABLE, 1 PATCHED/NOT-AFFECTED, 2 UNKNOWN
set -u

TARGET="${1:-}"
PORT="${2:-80}"

if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN: usage $0 <router-ip> [port]" >&2
  exit 2
fi

VULN_STRINGS=(
  "V15.03.06.51"                # AC6 V2.0
  "V15.03.06.48"                # AC5 V1.0
  "V15.03.06.46"                # AC10 V1.0
  "V15.11.0.5(1068_1567_841)"   # W15E V1.0
  "V1.2.0.14(408)"              # FH1201 V1.0
)

UA='noisgate-scanner/1.0'
TMP=$(mktemp)
trap 'rm -f "$TMP"' EXIT

# Grab landing page + typical Tenda status endpoints
for path in "/" "/login.html" "/goform/SysStatusRpm" "/system.asp"; do
  curl -sk --max-time 6 -A "$UA" "http://${TARGET}:${PORT}${path}" >> "$TMP" 2>/dev/null || true
done

if ! grep -qiE 'tenda|W15E|AC6|AC5|AC10|FH1201' "$TMP"; then
  echo "UNKNOWN: no Tenda fingerprint at ${TARGET}:${PORT} — target may not be a Tenda device, or UI is not on this port"
  exit 2
fi

for v in "${VULN_STRINGS[@]}"; do
  if grep -qF "$v" "$TMP"; then
    echo "VULNERABLE: Tenda device at ${TARGET} advertises firmware string '$v' — matches CVE-2026-11405 (CERT/CC VU#213560). No vendor patch exists."
    exit 0
  fi
done

echo "PATCHED-OR-NOT-AFFECTED: Tenda device detected but firmware string does not match any of the five known-vulnerable builds. Manually confirm firmware in System Tools -> System Status."
exit 1

Sources

1. CERT/CC VU#213560 — Tenda firmware hidden authentication backdoor
2. The Hacker News — CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware
3. ThreatINT CVE-2026-11405 record
4. Cryptika — Tenda Authentication Backdoor Grants Attackers Full Administrative Access
5. MITRE CWE-912 — Hidden Functionality
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS
8. Tenda official support / firmware downloads