Tenda firmware (multiple versions) contains hidden authentication backdoor

Original Article ↗ Hacker News Discussion ↗

Multiple Tenda home and small-business routers have been found to contain a hardcoded “rzadmin” login that bypasses normal authentication, and related firmware analysis suggests additional remote-access and data-collection capabilities. Commenters debate whether this kind of backdoor stems from incompetence, support/debug “convenience” or deliberate intent, but broadly see it as another example of insecure, opaque consumer networking gear. Many advocate isolating such devices behind custom Linux routers or using open firmware like OpenWrt to regain transparency and control.

Nature of the Tenda Backdoor

  • Firmware contains a hardcoded “rzadmin” credential stored as sys.rzadmin.username/password, base64-encoded but trivial to decode.
  • The backdoor password works regardless of the normal admin password and appears not to be changeable via the UI.
  • The username is reportedly not validated; any username paired with the backdoor password is accepted.
  • Some describe it as so obvious it’s “more front door than back door.”

Firmware Analysis and Extra Functionality

  • Newer firmware images are OpenSSL‑encrypted, making auditing harder.
  • At least one unencrypted image shows rzadmin and a guest/guest pair in config files.
  • Binary analysis suggests:
    • The httpd login function explicitly checks sys.rzadmin.password before throwing a “password wrong” error.
    • An imsd component can upload logs including SSIDs, MACs, IPs, admin usernames, and has a function to retrieve the admin password.
    • A related library exposes a command set that looks like cloud management / remote debugging plumbing.

Malice vs. Incompetence

  • Split views:
    • Some see this as a debug/support convenience (forgotten in production), consistent with many low‑end vendors and past industry practice (default admin/admin, etc.).
    • Others argue that in security one should not default to “stupidity”; plausible deniability makes deliberate backdoors look like accidents.
  • Several security‑focused commenters state that, in their experience, the vast majority of vulnerabilities are unintentional, though intent is ultimately unclear here.

Trust in Router Vendors and Alternatives

  • Many say this reinforces distrust of closed, vendor firmware on consumer routers.
  • Strong support for:
    • Using OpenWrt or similar where possible.
    • Rolling your own router/firewall on commodity hardware (thin clients, mini‑PCs, old laptops) and using separate access points.
  • Some note trade‑offs: OpenWrt may not fully exploit proprietary Wi‑Fi features (MIMO/beamforming), and high‑speed (>1 Gbps) routing can push people toward closed, hardware‑accelerated boxes.

Broader Security and Policy Concerns

  • Backdoors in network gear affect not just the owner but the wider internet (botnets, DDoS, etc.).
  • Several note that similar issues exist across vendors and countries; blaming one geography alone is seen as simplistic.
  • Frustration that intentional or negligent backdoors face little legal consequence, while security researchers can face harsh penalties.