CVE-2026-11405

Published Jul 6, 2026

Last updated 2 months ago

CVSS critical 9.8
Firmware

Overview

Description
The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8. - The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key). - After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configuration. - It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password. A successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor
Source
cret@cert.org
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Social media

Hype score
Not currently trending

  1. ⚠️ Masz router Tenda? Sprawdź aktualizacje firmware! CVE-2026-11405 to ukryty mechanizm uwierzytelniania, który może pozwolić na uzyskanie pełnego dostępu administratora bez właściwego hasła. Producent udostępnił poprawki. https://t.co/o8UFHTqRL1 #cybersecurity #

    @marekitlab

    2 Aug 2026

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. An undocumented backdoor in multiple Tenda devices allows admin access bypass. The flaw is tracked as CVE-2026-11405. https://t.co/aYqFOAwrgq #Tenda #backdoor #bypass #vulnerability #CVE #CybersecurityNews #CyberSecurity #threatresq #ThreatResQ

    @ThreatResq

    9 Jul 2026

    65 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact.•CVE-2026-18821
  2. IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition performing a network boot can prevent that partition from completing its boot sequence. On partitions where OS secure boot is not enabled, which is the default configuration, the attacker can also substitute the boot image, compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact.•CVE-2026-17414
  3. IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings.•CVE-2026-15961
  4. In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix firmware leak in async update The firmware object was not being released if validation failed. Use __free(firmware) to ensure the firmware is always released.•CVE-2026-72077
  5. By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.•CVE-2026-49006

References

Sources include official advisories and independent security research.