CVE-2026-11405 is a vulnerability in multiple Tenda router firmware versions caused by an undocumented authentication backdoor in the 'login()' function of the '/bin/httpd' web server binary. When standard MD5-based authentication fails, the firmware compares the supplied plaintext password against a hidden configuration value 'sys.rzadmin.password'. If they match, the device grants administrator access and creates a valid session regardless of the username. This backdoor is not documented or visible in the administrative interface, leaving users unaware of the risk. Successful exploitation allows full administrative control over the router, enabling reconfiguration, network setting changes, and disabling security features. Affected firmware versions include specific builds for Tenda FH1201, W15E, AC10, AC5, and AC6 V2 models. CERT/CC reports no patch is currently available and recommends disabling remote web management and restricting LAN exposure.

Exploitation grants full administrative access to the router's web interface regardless of configured administrator credentials. An attacker can reconfigure the device, alter network settings, and disable security features, potentially enabling broader compromise of the local network. No active exploitation has been reported yet, but the vulnerability is likely to be targeted by botnets and automated attacks.

No official patch or fix is currently available as the vendor has not responded. Users should disable the remote web management panel to prevent internet access to the vulnerable interface. Additionally, it is recommended to reduce local network exposure by changing the default LAN IP address to limit opportunistic discovery by automated scanners. Monitor vendor advisories for any future updates or patches.