Hidden Backdoor Authentication in Web Server Binary

Executive Summary

CVE-2026-11405 is a vulnerability in the /bin/httpd web server binary of certain Tenda firmware versions. It contains a hidden backdoor authentication mechanism within the login() function. Normally, the function verifies passwords using an MD5 hash-based method. However, if this normal authentication fails, the function reads a backdoor password stored in the device configuration and compares it directly in plaintext with the user-supplied password. If the backdoor password matches, the attacker is granted admin-level access (role=2) and a valid session is created, regardless of the username used.

This backdoor allows attackers to bypass normal password verification and gain full administrative access to the device's web management interface without valid credentials.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability allows attackers to gain full administrative access to the affected device's web management interface without needing valid credentials.

• Attackers can reconfigure the device settings.
• They can alter network configurations.
• Security features on the device can be disabled.

This can lead to compromise of the local network and potentially allow further attacks or unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a hidden backdoor password in the device configuration that allows admin access regardless of username. Detection involves checking for the presence of this backdoor password in the device configuration and monitoring for unauthorized admin-level access attempts.

Since the backdoor password is stored in the device configuration under the key "sys.rzadmin.password", you can attempt to query or inspect this configuration value if you have access to the device.

Network detection can include monitoring for unusual login attempts where any username is accepted but the password matches the backdoor password, granting admin access.

Specific commands depend on the device and firmware, but general suggestions include:

• Access the device configuration and check for the presence of the "sys.rzadmin.password" key.
• Use network monitoring tools to detect admin-level login sessions originating from unexpected sources.
• If possible, extract and analyze the /bin/httpd binary to verify the presence of the backdoor login() function.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling remote management features and restricting access to the device's web management interface to trusted local network users only.

Since no patch is available and the vendor has not responded, limiting exposure is critical to prevent exploitation.

Additional steps include monitoring for unauthorized access attempts and changing any known passwords that might be related to the backdoor.

Useful 0 Not Useful 0