Hidden Tenda router firmware backdoor (CVE‑2026‑11405) lets anyone admin in
CERT/CC disclosed that multiple Tenda router firmware versions contain an undocumented authentication backdoor in the /bin/httpd login routine. Exploiting CVE‑2026‑11405 bypasses password checks, granting full web‑interface admin rights without valid credentials. No vendor patch exists, so disabling remote management and limiting LAN exposure are the only mitigations.