Hidden Backdoor Found in Tenda Router Firmware

Security researchers have discovered a hidden backdoor in the firmware of several versions of Tenda routers. The vulnerability is tied to the authentication mechanism and could potentially allow an attacker to gain administrative access to the device's web management panel.

What the problem is

The backdoor is built directly into the firmware and affects several versions at once, which widens the pool of potentially vulnerable devices. The presence of a hidden authentication mechanism means that an attacker can bypass the standard login procedures and take control of the admin panel without the device owner's knowledge.

Why it's dangerous

Administrative access to a router's web interface opens up broad possibilities for an attacker: from changing network settings and redirecting traffic to using the device as an entry point into the user's internal network. Home and office routers often go without timely updates, which makes vulnerabilities like these especially long-lived.

Details about the specific affected models and firmware versions, as well as whether the manufacturer has fixed the issue, are not disclosed in the published material.

Users of Tenda devices are advised to keep an eye on firmware updates from the manufacturer and, where possible, to restrict access to the web management panel from external networks.

Source: Bleeping Computer