CVE-2026-11405 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-11405 | CVSS 9.8 (Critical) | Exploit: PoC available

What Is It

CVE-2026-11405 is a hardcoded backdoor authentication vulnerability in the web server binary /bin/httpd of an embedded device, allowing unauthenticated attackers to bypass normal credential verification and gain unauthorized access through a hidden plaintext password mechanism.

Technical Detail

The vulnerability exists in the login() function at offset 0x004c88b8 within the /bin/httpd binary. After the standard authentication path fails (which uses MD5-based hashing via prod_encode64, PasswordToMd5, and check_rand_key), the function falls through to a secondary code path that retrieves a backdoor password stored in the device configuration via GetValue("sys.rzadmin.password") and compares it against the user-supplied input using a direct strcmp() call in plaintext. An attacker who knows or can extract this configuration value can authenticate to the web interface without valid credentials, likely resulting in full administrative access to the device and potential for remote code execution depending on the capabilities exposed post-login.

Exploitation Status

A proof-of-concept (PoC) is publicly available. This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and active exploitation in the wild has not been confirmed as of July 10, 2026. However, the presence of a PoC and the straightforward nature of the bypass lower the bar for exploitation significantly.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability.

What To Do

Identify all devices running the affected /bin/httpd binary and check vendor advisories for firmware updates that remove the backdoor authentication path. If a patch is not yet available, restrict access to the device web management interface at the network perimeter using firewall rules or access control lists, ensuring the interface is not exposed to untrusted networks or the public internet. Audit device configurations for the presence of a value at sys.rzadmin.password and treat any populated value as an indicator of a vulnerable or potentially compromised device. Monitor web server authentication logs for login attempts that succeed without corresponding valid credential entries, which may indicate exploitation of this backdoor path. Given the CVSS score of 9.8 and the availability of a PoC, patching should be treated as high priority once vendor updates are released.