There’s an undocumented backdoor in Tenda firmware, and there’s no fix for it.
Tracked as CVE-2026-11405, the vulnerability lives in the login function of the web server binary. CERT/CC at Carnegie Mellon University published the warning after discovering that the authentication mechanism contains a hidden password stored in plaintext in the device configuration.
Here’s the problem: when authentication fails, the login function pulls a password from the device config and checks it against whatever the user supplied. Any username works. Only the password is checked. Guess what? The backdoor password is embedded in the firmware.
This affects Tenda routers, switches, and other networking gear.
An attacker who hits that backdoor gets full admin access to the web management interface. They can change network settings, disable security features, and potentially pivot deeper into the local network.
CERT/CC says it couldn’t coordinate with Tenda. There’s no patch.
Mitigations are limited but worth doing. Disable remote web management to prevent external attackers from reaching the login page. Change the default LAN IP address to reduce discovery by automated scanners.
In the same advisory, CERT/CC disclosed CVE-2026-13753 — an unpatched missing authorization vulnerability in HP Deskjet 2800 series printers. Sending GET requests to certain API endpoints returns Wi-Fi credentials, plaintext passphrases, serial numbers, and admin config data without any authentication.
Two unpatched hardware flaws in one week. That’s not a great look.
