A hidden backdoor authentication path exists in the Tenda firmware web server binary located at /bin/httpd. The login routine first checks if the provided password matches a stored MD5 hash. If that fails, it reads a configuration value sys.rzadmin.password. The routine then performs a direct plaintext comparison against the supplied password, ignoring the username. Any password that matches sys.rzadmin.password results in the creation of an admin-level session, granting the attacker full device control.

Tenda routers and network devices that run firmware containing the vulnerable /bin/httpd binary. The vendor identifies this product as Tenda firmware, and the vulnerability is present in multiple unspecified firmware releases. Devices running any firmware version that includes the backdoor code are affected.

The CVSS score of 9.8 indicates a critical vulnerability. The EPSS score of 2% suggests that exploitation is relatively unlikely, and the issue is not listed in the CISA KEV catalog. Nonetheless, an attacker who can reach the device’s management web interface—whether through local access or a remote connection—can supply the sys.rzadmin.password value and immediately acquire administrator rights. The description does not detail the required network port, so it is inferred that the vulnerable interface is reachable on the typical HTTP/HTTPS ports used for web management. The impact is immediate and total, affecting confidentiality, integrity, and availability of the device.