CVE-2026-11405
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A hidden backdoor authentication mechanism was discovered in the /bin/httpd binary within the login() function at address 004c88b8. After normal MD5/hash-based authentication fails, the system reads a backdoor password from the device configuration (sys.rzadmin.password) and compares it in plaintext using strcmp(). A match grants admin-level access (role=2) regardless of the username.
Risk Assessment
An attacker can gain full administrative access to the device by knowing the backdoor password stored in the configuration. This allows complete control over the device, data theft, or using it as an entry point into the internal network.
Recommendation
Immediately update the device firmware to a version without the backdoor. If an update is unavailable, restrict management interface access to trusted IP addresses and change default passwords.
Original NVD description (English source)
The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8. - The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key). - After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configuration. - It performs a direct strcmp() comparison (plaintext, not hashed) between the config value and the user-supplied password. A successful match grants role=2 (admin-level access) and creates a valid session. The rzadmin username is never checked — any username works with the backdoor