CERT VU#213560 documents hardcoded credential in Tenda AC and AX firmware enabling remote admin bypass

The note covers firmware releases for AC6, AC7, AC8, AC9, AC10, AC15, AC18, AX12, AX23, and related models shipped between 2018 and 2023. Researchers located the bypass through static analysis of the httpd binary; the credential is compared against a fixed value in the authentication handler before any session token is issued. Affected binaries were recovered from public firmware archives and confirmed on physical devices running versions up to 15.03.06.18.

NVD cross-references show twelve prior Tenda CVEs since 2020 that also originated from unaudited CGI endpoints and absent input sanitization. Shodan and Censys snapshots from 2024 indicate more than 180,000 exposed Tenda management interfaces worldwide, concentrated in residential and small-office deployments. The pattern matches systemic absence of authenticated firmware signing and reproducible build processes across low-cost router vendors.

Operationally, the backdoor removes the requirement for network adjacency or credential theft, allowing direct WAN or LAN exploitation once the device IP is reachable. Firmware update mechanisms on these models rely on unauthenticated HTTP endpoints, so remote attackers can also push replacement images. No coordinated disclosure timeline or patch distribution metrics have been published by Tenda.

Downstream integrators and ISPs that rebrand these boards inherit the same binary. Replacement cycles for consumer routers average four to seven years, extending the exposure window beyond typical support commitments.