A backdoor in multiple firmware versions from networking vendor Tenda lets unauthenticated attackers reach a device's web management interface, tracked as CVE-2026-11405, as reported by SecurityWeek. At the time of disclosure there was no patch available.

An undocumented authentication bypass baked into firmware is close to a worst case for a network device, because it is not so much a bug to be triggered as a door left in the wall. Anyone who knows it is there can walk in, and consumer routers are rarely watched for that kind of entry.

Devices like these are the raw material of botnets. Home and small-office routers with remote-reachable admin panels get swept up at scale to relay attacks, proxy malicious traffic, and hide an intruder's origin. A no-fix backdoor in a widely sold brand is precisely the sort of thing that quietly grows an operational relay network.

Until a patch ships, the defensive moves are to make sure the management interface is not exposed to the internet, disable remote administration, and segment these devices away from anything sensitive. Where firmware cannot be trusted and cannot be fixed, reducing what it can reach is the only lever left.

Sources: SecurityWeek; CERT/CC.