Tenda Routers Have Backdoors. Here's How They Work

The router sitting behind your TV right now is almost certainly running software you've never looked at, configured by a manufacturer you've probably never thought about, and protected by security practices you've definitely never audited. For most people, the router is infrastructure—invisible until the internet goes down. That invisibility is exactly what makes it interesting to people who hunt bugs for fun.

The YouTube channel Low Level recently published a video documenting a bug-hunting session targeting a Tenda router—a brand with a significant footprint on Amazon, where the device in question has accumulated roughly 18,000 reviews. What started as a plan to verify a previously reported backdoor turned into something considerably more involved.

The video is worth watching if you have any tolerance for assembly code and reverse engineering. But the broader picture it paints—about how cheap consumer networking hardware gets built, and what's living inside firmware images that ship to millions of homes—is worth understanding even if you don't.

Layer One: The Backdoor That Was Already Known

The researcher's starting point was a reported vulnerability: an undocumented password in Tenda's router web interface that would let anyone log in without knowing the actual admin password. The web interface of a home router—the page where you set your Wi-Fi name, change your password, manage connected devices—is controlled by a binary called httpd. It's the web server living on the router.

The methodology here is standard firmware analysis. Download the firmware image from Tenda's own website (this is public and intended), run it through a tool called binwalk, and extract the embedded file system. From there, open httpd in Ghidra—a reverse engineering framework that takes machine code and reconstructs a human-readable approximation of the original source code—and look at the login-handling function.

What the researcher found in that function was two separate authentication paths. One is normal: compare the user-provided password against the stored admin password. The other is not: a hardcoded credential called rz_admin that bypasses the normal authentication flow entirely. The password for this second path was sitting in the router's default.config file, base64-encoded—a trivial obfuscation that roughly translates to "hidden from anyone who doesn't look."

"This rz_admin was an undocumented password in the Tenda line of router that you're able to use to log into the router for free and you cannot change it," the researcher explains. "So if you know the password, you can get in."

As it turned out, the specific router he'd purchased wasn't vulnerable to this particular backdoor—he'd bought the wrong model version. A less determined person stops here. He did not.

Layer Two: The Encrypted Firmware Problem

Switching focus to his actual device—a Tenda AC10 V6—he tried the same binwalk approach on the relevant firmware. This time, instead of an extractable file system, the firmware image returned only an encrypted blob. The contents were inaccessible without a decryption key he didn't have.

The researcher's read on this is pointed: "What that tells me as a researcher is that Tenda is hiding something. There is something on this router that they don't want you and I to see."

That's an inference, not a fact—worth noting. Firmware encryption has legitimate uses. It can protect proprietary code from competitors, prevent counterfeit hardware from running official software, and reduce the surface area for certain classes of attack. But it also, as a side effect, makes independent security auditing much harder. When a manufacturer encrypts firmware, the security research community loses one of its most reliable tools for checking whether the device is actually safe.

The tension here is real and not easily resolved. Encryption as a security feature versus encryption as a transparency shield—these are not always the same thing, and the distinction matters enormously when the device in question is sitting between your household and the internet.

Layer Three: The Telnet Door That Opens Itself

Stalled on the encrypted firmware, the researcher went looking for known vulnerabilities in related Tenda models. He found a remarkable one: on the Tenda AC20, sending a simple HTTP request to /goform/telnet—no authentication required—enables the Telnet service on the device. One unauthenticated web request, and you've turned on a remote shell interface.

He tested this on his AC10 V6. It worked.

Telnet is a decades-old protocol that security professionals generally treat as a relic—it transmits everything in plaintext and has been superseded by SSH for anything that requires real security. The fact that it's present in consumer router firmware, and that it can be activated without credentials, is the kind of thing that tends to make security researchers visibly upset.

He now had a Telnet prompt. But the prompt asked for a root password, and that password was locked inside the encrypted firmware he still couldn't read. Circular problem.

Layer Four: The Password That Prints Itself

Here's where the research gets genuinely interesting—not because the vulnerability is sophisticated, but because of how unsophisticated the underlying mistake is.

The researcher found references to a pattern used in another Tenda model (the AC8) where the root password is algorithmically derived: take bytes from the router's MAC address, concatenate them with a hardcoded string unique to each device model, base64-encode the result, and that's your root password. The MAC address is freely visible on the local network. The hardcoded string is the only secret—and it's stored in the encrypted firmware.

On his device, that string wasn't the AC8 string. But in trying to understand how the password was generated on his specific model, he noticed something: after the password is calculated at boot time, the router prints it to its serial console output.

Consumer routers don't have screens. But they do have serial console hardware—physical pads on the circuit board that, if you attach the right equipment, let you read everything the device outputs during boot. It's standard embedded systems infrastructure, typically used during development and debugging. It's often left accessible on shipping hardware.

He attached a serial console to the router, performed a factory reset, and watched the device boot. The password printed itself to the console during provisioning.

"For some godforsaken reason they print it to the screen," he says.

He used that captured password to authenticate over Telnet. Root shell, full access to the device. From there, he found a binary on the router called decrypt_firmware—and used it to decrypt the firmware image he'd been unable to read.

He's not publishing the decryption keys yet: "I will be writing a blog post with those keys. I have to clear it with my lawyer first, I think, is the game plan just to make sure I don't get sued."

What This Actually Means for You

Let me be direct about the threat model here, because this is the part of router security coverage that tends to go sideways into either "everything is fine" or "we're all doomed."

The serial console attack requires physical proximity—you need to be near the device. The Telnet-enabling endpoint, however, only requires network access. On a home network, "network access" means any device already connected to your Wi-Fi could potentially trigger it. On a network where someone has already compromised another device—or where the router's Wi-Fi password is weak—the exposure is real.

The undocumented rz_admin backdoor, where it exists in vulnerable firmware versions, is accessible to anyone who can reach the router's web interface. For most people that's local-network-only, which limits exposure. But "limited" isn't the same as "none," especially in shared living situations, small offices, or anywhere the network perimeter isn't a given.

The broader pattern the researcher highlights is harder to dismiss than any individual vulnerability. He points to a GitHub repository documenting multiple independent bugs across just one Tenda model—the AC18—each capable of producing code execution. "It's been like 10 years," he says of Tenda's security track record, "and it feels like every couple of years there's some new breaking story where they accidentally left in some firmware backdoor or some crazy vulnerabilities. Plural, by the way."

Whether that constitutes a systemic problem or bad luck in a notoriously difficult engineering environment is a question the available evidence doesn't definitively settle. What it does settle: Tenda routers have been scrutinized repeatedly by independent researchers, and the findings have not been reassuring.

What You Can Actually Do

If you're running a Tenda router, the practical steps are the same as for any consumer networking hardware with a security history worth knowing about:

Check for firmware updates. Manufacturers do patch vulnerabilities. Whether the patches are comprehensive is a separate question, but running outdated firmware when patches exist is strictly worse than running current firmware.

Change the default admin password to something long and random, and change your Wi-Fi password if it's weak. These don't fix backdoors, but they reduce the surface area for attacks that require authentication you control.

If you're technically comfortable, audit what services your router is exposing—particularly whether Telnet or any remote management interface is enabled and accessible.

And if you're shopping for a router: the security track record of a manufacturer is a legitimate purchasing criterion, not a paranoid one. Some brands invest more in security auditing than others. That information is publicly available to anyone willing to search for it.

The researcher frames his work as a "fun exercise in finding bugs." Fair enough—the methodology is genuinely educational. But the bugs he's finding are sitting in hardware that tens of thousands of households are using as their primary line of network defense. The exercise and the stakes are not in tension. They're the same conversation.

---

Rachel "Rach" Kovacs covers cybersecurity and privacy for Buzzrag.