We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·28d ago·5 min read
Tenda firmware (multiple versions) contains hidden authentication backdoor
TL;DR
Multiple versions of Tenda firmware have been found to contain a hidden authentication backdoor that allows unauthorized administrative access. This vulnerability, identified as CVE-2026-11405, enables attackers to bypass standard password protections.
✦ Why It Matters
Review and update Tenda firmware immediately to mitigate the risk of unauthorized access through this backdoor.
Key Takeaways
- Update Tenda firmware to the latest version.
- Implement additional security measures for network devices.
- Monitor network traffic for unauthorized access attempts.
- Educate users about potential vulnerabilities in their devices.
Full Summary
Tenda, a manufacturer of networking devices, has multiple firmware versions that include an undocumented backdoor in their web server's login function. Normally, the login process uses MD5-based password verification, but if this fails, the function retrieves an alternate password from the device's configuration.
This backdoor allows any username to authenticate successfully with the backdoor password, granting administrative access without proper credentials. The affected firmware versions include US_FH1201V1.0BR_V1.2.0.14 and others.
This vulnerability poses significant security risks, as it can be exploited by attackers to gain unauthorized control over network devices. Engineers and researchers must be aware of such vulnerabilities to ensure device security and integrity.