Your Tenda router could have a hidden firmware backdoor - disable this setting ASAP

2026-07-09 · Source: News and Advice on the World's Latest Innovations | ZDNET · Field: Technology & Digital — Cybersecurity & Data Privacy, Cloud Computing & IT Infrastructure · Depth: Novice, quick

Summary

An undocumented backdoor has been found in several firmware versions of popular Tenda routers. Tenda is a brand selling network equipment via channels like Amazon. The CERT Coordination Center (CERT/CC) reported this vulnerability, discovered by an anonymous researcher. This backdoor is a baked-in admin password. It allows anyone who knows it to bypass access control and gain full remote access to the router's internal settings. Attackers can then run network scans, grab Wi-Fi passcodes, set up port forwarding, and disable security features. The backdoor is remotely exploitable over the internet, and its details are easily discoverable, suggesting widespread exploitation. Affected firmware versions include US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD, US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE, US_AC10V1.0re_V15.03.06.46_multi_TDE01, US_AC5V1.0RTL_V15.03.06.48_multi_TDE01, and US_AC6V2.0RTL_V15.03.06.51_multi_T. Tenda has not yet responded to inquiries regarding a patch.

Key takeaway

If you manage network infrastructure or use Tenda routers at home, immediately disable remote web management. Also, change your router's default LAN IP. These steps are critical to mitigate remote exploitation via the undocumented firmware backdoor. Tenda has not provided a patch or timeline. Therefore, your network remains vulnerable to unauthorized access, data theft, and configuration changes without these actions. Consider alternative router brands if you require robust security and vendor support.

Key insights

Tenda routers contain a remotely exploitable firmware backdoor, allowing full administrative access via a known password.

Principles

• Undocumented firmware backdoors pose severe remote access risks.
• Publicly known vulnerabilities increase immediate exploitation threat.
• Vendor unresponsiveness delays critical security patch deployment.

Method

Attackers use a baked-in admin password to bypass router access control, then remotely access internal settings to scan networks, steal Wi-Fi passcodes, or reconfigure ports.

In practice

• Disable remote web management on Tenda routers.
• Change your Tenda router's default LAN IP.
• Avoid Tenda hardware if open-source firmware is desired.

Topics

• Tenda Routers
• Firmware Backdoor
• Remote Exploitation
• Network Security
• Vulnerability Disclosure
• Access Control Bypass

Best for: Security Engineer, IT Professional, General Interest

Related on AIssential

• Your router may be vulnerable to Russian hackers, FBI warns: 5 steps to take now — The FBI and NSA have issued new advisories warning that Russian GRU cybercrime group APT28 (aka Fancy Bear/Forest Blizzard) is actively targeting vulnerable routers globally, including small office/ho…
• There are 3 obvious signs someone is stealing your Wi-Fi - and several ways to stop them — Unexplained Wi-Fi slowdowns or unknown devices signal potential network intrusion, risking privacy and bandwidth.
• The disappearing office IP — Distributed work invalidates the office IP as a security boundary, necessitating managed egress points for consistent network identity.
• BadHost Vulnerability Exposes AI Agents, Evaluators, and LLM Gateways — Malformed HTTP Host headers in Starlette enable authentication bypass by shifting URL path interpretation.
• As ransomware recedes, a new more dangerous digital parasite rises — Threat actors are shifting from ransomware encryption to stealthy, long-term data extortion via "sleeperware."
• Attackers Are Exploiting Vulnerabilities 7 Days Before the Patch Exists. Now What? — The patch window is gone; AI-accelerated exploitation now precedes patch availability, demanding a shift to exploitation-based prioritization.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by News and Advice on the World's Latest Innovations | ZDNET.