Tenda Router Vulnerability Grants Passwordless Admin Access: Manufacturer Ignores Issue

Cybersecurity experts at CERT Coordination Center (CERT/CC) have identified a critical vulnerability in the firmware of routers manufactured by Chinese company Tenda. Tracked as CVE-2026-11405, the flaw is a hidden backdoor that allows attackers to bypass standard authentication and gain administrative access to the device without entering a password.

The issue affects multiple router models, including FH1201, W15E, AC10, AC5, and AC6. CERT/CC’s report notes that the list of vulnerable devices may be broader, as the manufacturer has not provided official data. The vulnerability stems from an undocumented authentication mechanism that activates after a failed login attempt using the default password.

Exploiting this flaw enables attackers to gain full control over the router, including the ability to modify network settings, hijack DNS servers, disable security features, and create new user accounts. This poses significant risks to both home and corporate networks, as the router serves as the gateway between local devices and the internet.

Despite warnings from CERT/CC, Tenda has not released any patches to address the vulnerability. Experts recommend users disable remote router management and restrict access to the admin panel from the local network to reduce attack risk. Changing the router’s IP address may also hinder detection by automated scanners, though it does not protect against targeted attacks.

The manufacturer’s lack of response highlights growing regulatory concerns about the security of networking equipment, particularly devices manufactured abroad. Such vulnerabilities can be exploited to build botnets or launch targeted attacks on corporate and private user infrastructure.