The Tenda firmware's /bin/httpd web server binary includes a hidden backdoor in its login() function. Normally, authentication uses MD5 hash-based password verification. However, if this fails, the code reads a backdoor password from the device configuration key "sys.rzadmin.password" and compares it directly in plaintext to the user-supplied password. If matched, it grants admin-level access (role=2) and creates a valid session, ignoring the username. This CWE-912 (Hidden Functionality) vulnerability enables unauthorized administrative access.

Successful exploitation grants an attacker administrative privileges on the device without needing a valid username or the normal password. This leads to full compromise of the device's management interface, potentially allowing configuration changes, persistent control, and further network compromise. The CVSS score of 9.8 reflects critical impact with network attack vector, no privileges or user interaction required, and full confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/213560 for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for unauthorized access attempts. Avoid exposing the device management interface to untrusted networks.