Security News Tenda Authentication Backdoor Grants Attackers Full Administrative Access

[Parkinsond]

Content source

https://cybersecuritynews.com/tenda-authentication-backdoor-grants-access/

A newly disclosed vulnerability in Tenda network devices exposes a critical authentication backdoor that allows attackers to gain full administrative access without valid credentials.

The flaw affects multiple firmware versions across several Tenda router models, including the FH1201, W15E, AC10, AC5, and AC6 series.

These routers are widely used in home and small business environments, where they rely on web-based management interfaces secured by username and password authentication.

Tenda Authentication Backdoor Grants Attackers Full Administrative Access

A newly disclosed Tenda flaw exposes an authentication backdoor allowing attackers to gain full admin access without valid credentials.

cybersecuritynews.com

 

[Divine_Barakah]

Zero excutables required!
Zero user interaction!
What if the cafe was using one of these Tends?

Did you even read the article?

 

[Parkinsond]

Zero excutables required!
Zero user interaction!
What if the cafe was using one of these Tends?

Did you even read the article?

Again, need enabling "remote management" by some ignorant user missing aroud with the router settings

 

[Divine_Barakah]

Again, need enabling "remote management" by some ignorant user missing aroud with the router settings

You're conflicting WAN with LAN.

CVE-2026-11405 backdoor explicitly notes that disabling remote management only prevents attackers on "external networks" from acessing the administrative dasboard over the internet.

If the attacker is on the cafe Wi-Fi, they are already on the Local Area Network (LAN). They do not need 'Remote Management' enabled to access the router's local gateway IP. The CVE-2026-11405 backdoor grants full administrative control over the local web management interface, allowing an attacker already inside the network to take over the router and execute the exact Man-in-the-Middle attacks we were discussing.

You proved my point again: connecting to a public Wi-Fi puts you behind the firewall with potential attackers, entirely bypassing the need for remote WAN management.