CERT/CC has published VU#213560 for CVE-2026-11405, an unpatched hidden authentication backdoor in multiple Tenda firmware builds. The issue affects the web management interface on listed Tenda devices and can allow administrative access without valid configured credentials.
This is not just a home-router problem. Small offices, branch sites, managed Wi-Fi installs, contractor networks, lab racks, retail locations, and customer edge networks often keep low-cost routers running for years. If one of these devices is exposed to the internet or reachable from an untrusted network segment, treat it as an urgent inventory and isolation item.
What CERT/CC Published
CERT/CC vulnerability note VU#213560 lists CVE-2026-11405 as affecting these Tenda firmware builds:
- US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD
- US_W15EV1.0br_V15.11.0.5(1068_1567_841)_EN_TDE
- US_AC10V1.0re_V15.03.06.46_multi_TDE01
- US_AC5V1.0RTL_V15.03.06.48_multi_TDE01
- US_AC6V2.0RTL_V15.03.06.51_multi_T
The vendor status is still unresolved in the CERT/CC note. CERT/CC says it was unable to coordinate a patch with the vendor, so the practical guidance is mitigation, exposure reduction, and replacement planning until a fixed firmware is available.
Immediate Admin Checklist
- Inventory Tenda routers, access points, and customer edge devices, including storage closets, temporary offices, lab benches, and old failover links.
- Compare the installed firmware version with the affected firmware list from CERT/CC and the CVE record.
- Disable remote web management wherever it is enabled.
- Restrict management access to a trusted admin VLAN, VPN, or physically controlled maintenance network.
- Block public internet access to the device management interface at the upstream firewall or ISP edge.
- Change all ordinary administrator credentials, but do not treat a password change as a complete fix for this issue.
- Review configuration changes, DNS settings, port-forwarding rules, VPN settings, wireless settings, and administrator accounts for unexpected changes.
- Plan replacement for affected devices if no fixed firmware is available for the deployed model.
Small Business And Hosting Relevance
Hosting providers, MSPs, web developers, and WordPress maintainers should pay attention when customer networks rely on consumer or small-business routers. A compromised edge router can redirect DNS, expose internal devices, break secure remote access, or interfere with customer support sessions even when the website itself is patched.
If you manage a customer environment, ask whether the office router is on the affected list before assuming a strange DNS, certificate, VPN, or admin-login problem is purely a web-hosting issue.
What To Tell Non-Technical Owners
The short version is: some listed Tenda firmware builds include an undocumented administrative access path, and CERT/CC does not list a vendor patch yet. Owners should disable remote management, keep management access off the public internet, and replace affected devices if a fixed firmware is not available.
FixItPhill Take
CVE-2026-11405 is the type of edge-device issue that gets missed because it sits outside the WordPress dashboard, cPanel, or cloud console. For admins, the safe order is inventory, isolate, review configuration, then replace or patch. Do not wait for a website symptom before checking the router layer.