Welcome back, aspiring cyberwarriors!

If you’ve spent any time hunting through vulnerability databases, you may have noticed a recurring trend involving a certain brand of budget networking gear. Tenda routers appear time and again, not because researchers have it in for the company, but because of persistent, systemic security failures that remain largely unaddressed. These issues have almost turned Tenda into a textbook example of what not to do when it comes to product security management.

In this article, we’ll explore the reasons behind Tenda’s notorious reputation, examine the modern threats posed by their devices, and dive into a practical lab to exploit one of their information-disclosure vulnerabilities. Let’s get rolling!

What is Tenda?

Tenda is a Chinese manufacturer of networking hardware, primarily recognized for offering budget-friendly equipment for home and small business networking. Their product lineup includes wireless routers, range extenders, network switches, and IP cameras.

At first glance, you might overlook Tenda as just a small Chinese company without significant influence. However, a quick search on Shodan reveals an entirely different story.

There are over 12,000 hosts that could potentially serve as gateways for both the Chinese government and hackers worldwide to access various networks.

Problem #1: A Culture of Silence

To understand the issues with Tenda, it’s essential to recognize a troubling pattern of behavior rather than focusing on a single vulnerability. When Carnegie Mellon’s CERT/CC identifies a significant backdoor in the firmware of several router models and reaches out to Tenda for a coordinated disclosure, one might expect a company of Tenda’s stature to acknowledge the issue and take steps toward a resolution. Unfortunately, that hasn’t been the case. CERT/CC’s recent advisory on this backdoor reveals that Tenda has remained silent since they were contacted in May 2026, with no patches released for any of the five affected router models.

This isn’t just a one-off incident. Back in 2020, researchers from Independent Security Evaluators discovered a hardcoded telnet password embedded in the Tenda AC15 AC1900. They notified the company and waited nearly double the standard 90-day disclosure period without receiving a response, ultimately publishing their findings without any acknowledgment from Tenda. If you look even further back to 2013, you’ll find a security researcher documenting a LAN-side backdoor in the Tenda W302R and W330R routers, which was also never patched. When a company remains unresponsive for over a decade and across multiple hardware iterations, it indicates a fundamental flaw in its business model rather than just a series of mistakes.

Problem #2: Hardcoded Credentials

The scale of Tenda’s problems becomes even clearer when looking at firmware analysis studies instead of individual disclosures. Research scanning extensive batches of Tenda firmware images has revealed that nearly one in five contain hardcoded default credentials or even empty passwords embedded directly in the binary. This isn’t a rare oversight; rather, it points to a recurring design choice made across an entire line of products. When you combine this statistic with a vendor that ignores security disclosures, it means Tenda is, in effect, distributing routers that come pre-loaded with vulnerable access points, easily exploitable by anyone who knows where to look.

Problem #3: The Backdoor that Makes Changing Your Password Meaningless

A particularly egregious example is CVE-2026-11405. This vulnerability deserves special attention due to the way it undermines the basic principles of router security. It resides within the login function of the httpd web server binary that runs on several router models. Typically, when a user submits a password, the router checks it using MD5-based verification. However, if this check fails, instead of simply rejecting the login attempt, the code unwittingly falls through to a second, undocumented authentication route. It retrieves a hidden configuration value called sys.rzadmin.password and directly compares it in plaintext to the password submitted by the attacker. If they match, the router grants administrative access at role level two, and critically, the username input during this attempt isn’t validated at all. This means that any username coupled with the correct backdoor password gains access.

Consider the implications for an average user who has followed all the right steps. You purchase the router, log into the web interface, and change the default admin password to a strong, unique one, just as every security guide advises. Unfortunately, none of that matters here since the backdoor password exists entirely outside the interface that you interacted with. It is stored in the device’s configuration, hidden from any user-facing menu and unaffected by any password changes you make through the regular admin panel. The only way to eliminate this risk is through a complete firmware rewrite from the vendor, and as of now, Tenda has provided no indication that such an update is forthcoming.

Problem #4: Crashing Devices Without Authentication

Backdoors aren’t the only serious vulnerability affecting this ecosystem. CVE-2026-36794 targets the Tenda W3 router and highlights a stack-based buffer overflow that an unauthenticated remote attacker can exploit simply by sending a specially crafted HTTP request.

There’s no need for a login or any user interaction; the attacker just requires network access to the device’s web interface. The consequence is a device crash, leading to a straightforward denial of service.

Practical Lab: Pulling Credentials Out of the Tenda N300

Now, let’s dive right in. While the recent backdoor vulnerability we discussed is certainly eye-catching for 2026, today we will focus on an older issue: CVE-2020-35391, which affects the Tenda N300. I have chosen this example intentionally, as it highlights a troubling trend within Tenda, specifically the consistent shipping of exploitable authentication flaws.

The issue lies in how the router manages configuration backup requests. Normally, an authenticated administrator can easily request a copy of the device’s configuration file for backup by accessing an endpoint at cgi-bin/DownloadCfg/RouterCfm.cfg. The problem arises because this endpoint fails to properly enforce authentication before releasing the file. An attacker can simply send a direct request to that endpoint and sometimes gain access to the complete configuration file. Once you have that configuration file, open it up and find the line labeled extend_pass.

That single line contains the administrative password for the router’s web interface, made accessible without any login credentials. From here, exploiting this vulnerability is straightforward. Just take that password, navigate to the router’s usual login page, and authenticate as the administrator. You will then have full control over the device, including its DNS settings, port forwarding rules, and every device connected behind it.

Summary

These days, Tenda hardware remains quite popular in various countries due to its affordability. However, we must be more cautious about security, as overlooking it could lead to significantly higher long-term costs.

If you’re interested in exploring how to both attack and secure routers, consider enrolling in the VPN & Router Hacking course. This course delves into router exploitation through manual RCE (Remote Code Execution), information disclosure, and unauthorized code execution on devices like Netgear, Netis, and Telesquare, as well as enterprise-grade systems like FortiPAM and FortiSwitchManager – and much more.

The post Router Hacking: Why the World’s Most Popular Budget Router Keeps Making Headlines for the Wrong Reasons first appeared on Hackers Arise.