CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware

Several versions of firmware released by Chinese network device manufacturer Tenda have been found to embed an undocumented authentication backdoor that enables administrative access to the devices' web management interfaces, the CERT Coordination Center (CERT/CC) warned Monday. "An attacker can exploit this vulnerability, tracked as CVE-2026-11405, to bypass the password verification process

The article reports that multiple Tenda router firmware versions contain an undocumented authentication backdoor (CVE-2026-11405) in the /bin/httpd web server’s login() function, allowing an attacker to bypass normal password verification and gain full administrative access via a hidden rzadmin password path.[1][2] CERT/CC notes the issue is currently unpatched and that successful exploitation enables full device takeover, reconfiguration, and disabling of security features, with mitigations limited to disabling remote management and changing default LAN IPs.[1][2] From a RealGround perspective, this illustrates a critical firmware-level supply chain risk: network devices with opaque, proprietary code can embed backdoors that directly undermine any AI agents or automated systems that rely on them for secure connectivity or data collection. Organizations should treat such routers as untrusted infrastructure components, integrate firmware provenance and vulnerability checks into their AI SBOM and asset inventories, and prioritize network segmentation, strict access controls, and vendor risk review before deploying them in environments that support AI workflows or agent operations