Unpatched Backdoor in Tenda Firmware Grants Admin Access to Devices
AdvisoryTenda FirmwareHP Deskjet 2800 Series PrintersOur summary
A security researcher uncovered an undocumented backdoor in several versions of Tenda firmware that allows attackers to gain administrative access to the device's web management interface. The flaw, tracked as CVE-2026-11405, resides in the login function of the web server binary and enables authentication bypass. Additionally, CERT/CC reported another vulnerability in HP Deskjet 2800 series printers (CVE-2026-13753), where unauthenticated access to API endpoints exposes sensitive information like Wi-Fi credentials and printer serial numbers. Both issues remain unpatched, and users are advised to disable remote web management and update their configurations to mitigate risks.
SecurityWeek publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.