A researcher’s accidental purchase of an AC10V6 router led to a surprising discovery of deeper security flaws in Tenda devices, exposing full access routes and potential backdoors, highlighting the ongoing risks in consumer networking hardware.
A mis-purchased router turned into an unexpectedly useful security experiment after a researcher set out to study a Tenda model tied to CVE-2026-11405, only to discover they had bought an AC10V6 instead. Rather than treating that as the end of the exercise, the researcher began looking for weaknesses in the “wrong” device too, and ended up uncovering a route to full access that may be even more revealing than the original target.
The investigation started in the usual way: by downloading firmware from Tenda, unpacking it with binwalk, and then digging through the binaries with Ghidra to look for anything suspicious around the login process and input handling. Tenda’s decision to encrypt the firmware image immediately complicated matters, but it also pushed the work in a new direction and made older flaws in other Tenda products more relevant to the search.
That detour proved useful. Previously disclosed issues in other models showed that some Tenda routers could be pushed into exposing Telnet, including CVE-2025-9090 on the AC20. Another flaw, CVE-2025-52054, described a way to derive the root password from a static string and the final two octets of the router’s MAC address. In this case, the missing piece was the static string itself, and early attempts to reuse values from other models did not work.
The breakthrough came from the router’s serial console. By probing the UART pins and performing a hard reset, the researcher was able to watch the device boot and recover the password data before Base64 encoding. Entering the resulting string over Telnet granted root access, which in turn exposed the decrypted firmware and the keys needed to open the image that had initially seemed protected. That kind of chain, one vulnerability helping unlock the next, has become a familiar pattern in router research, and it underlines why so many consumer devices remain fragile long after release.
Separately, reporting on CVE-2026-11405 has described it as a hidden backdoor that can give unauthenticated attackers full administrative control, particularly if remote web management is left enabled. Gridinsoft and Tom’s Hardware both reported that Tenda had not publicly acknowledged or fixed the issue at the time of publication, while security briefings have urged owners to check firmware versions and reduce exposure by disabling remote administration where possible. The broader lesson is simple: on bargain routers, one flaw often leads to another, and the cost of convenience can be surprisingly high.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
