If you've ever reviewed authentication code and felt a little itch when you saw an if (authFailed) { tryAnotherWay() } branch — congratulations, your instincts are correct. That exact pattern is at the center of a newly disclosed backdoor affecting multiple Tenda router models, and it's a great case study in how not to design an auth flow.
Let's break down what's actually happening in the firmware, why it matters beyond "yet another router CVE," and how you'd go looking for something like this yourself.
The TL;DR
CERT/CC (Carnegie Mellon's Software Engineering Institute) published VU#213560 / CVE-2026-11405 on July 6, 2026, describing an undocumented authentication bypass in the /bin/httpd binary shipped on several Tenda router firmware builds:
US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD
