The Tenda firmware contains a hidden backdoor in its web server binary's login() function. Normally, authentication uses MD5/hash-based password verification. However, if this fails, the code reads a backdoor password from the device configuration key "sys.rzadmin.password" and compares it directly in plaintext against the user-supplied password. A match grants admin-level access (role=2) and creates a valid session without verifying the username, effectively allowing unauthorized administrative access via this hidden functionality.

Successful exploitation grants administrative access to the device's web interface without proper authentication, potentially allowing full control over the device. This undermines device security by bypassing standard authentication mechanisms through a hidden backdoor password stored in configuration.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/213560 for current remediation guidance. Until an official fix is available, restrict access to the device management interface to trusted networks and monitor for unauthorized access attempts.