- Tenda firmware versions contain an undocumented authentication backdoor allowing administrative access without valid credentials.
- An attacker can bypass password verification via the backdoor, tracked as CVE-2026-11405, to gain full control.
- Affected devices include specific firmware versions of US_FH1201, US_W15E, US_AC10, US_AC5, and US_AC6.
- The backdoor involves a login() function in /bin/httpd that retrieves an alternate password via GetValue("sys.rzadmin.password").