It’s rather awkward when you buy a piece of hardware like a sketchy router to make a video about its hidden admin password backdoor – known as CVE-2026-11405 – only to discover that you bought the wrong Tenda router, namely the AC10V6 model. After making this mistake, [Low Level] did the only reasonable thing one ought to do in this case, and try to find an exploit in this ‘wrong’ router as well.
The obvious start here is to do the same as with the other exploit, in that you download a firmware image from the manufacturer’s website, then pluck it apart using binwalk to do an initial check for juicy files. After that tools like Ghidra can be used to do a more in-depth analysis of any binary files, with a special focus on things like user-facing elements like login screen, as input validation will likely forever remain the number one type of exploited CVE.
One major change that Tenda made here was to encrypt the firmware image, which seemed suspicious. With that easy path blocked, the research of others on different Tenda routers was looked at, including the AC20 with the fascinating Telnet exploit in the form of CVE-2025-9090 where merely poking a file on the device turned on the Telnet service. This left the minor issue of finding a password to log into said Telnet session.
This is where CVE-2025-52054 comes in handy, as this explains how to calculate the root password of a Tenda router using a static string and the last two octets of the device’s MAC address. The unfortunate aspect here is that this static string is unknown for this particular router, and the AC8 version did not work. Luckily, for some unknown reason Tenda did decide that they had to print this secret information to the serial output, ergo it was time to probe the UART pins on the router’s guts.
One hard reset later and the console output on these UART pins happily showed that the password pre-Base64 encoding was 9cUFeUZC_125700. Mashing in the Base64-encoded string in the Telnet login gave root access and completed the first step of the whole fun, as now [Low Level] also had access to the decrypted firmware including the decryption keys for the previously safely encrypted firmware image.
There will be a blog post published with likely the keys and other details after clearing it with [Low Level]’s lawyer, but even at this point it’s truly a tragedy of CVEs on the side of Tenda that led to this outcome. If you ever needed a reason not to let friends use Tenda routers, this has got to be another good reason.
Why buy some Amazon trash that looks like it’s straight out of 2010s video game when for similar price you could have a good enough Mikrotik?
regional availability
Having physical access should always allow arbitrary execution. If not, it’s not really your router, and there’s no way to endure it’s running secure software.
It’s also just not the kind of exploit I’d be worried about. If an attacker has physical access to my networking hardware, I’d expect it to be compromised. That’s a big hurdle and an exploit doesn’t scale, though. Considering how many companies are vulnerable to the exploit of “call the CFO and tell them to wire a bunch of money to your account”, ninja hacker burglars aren’t that big of a concern in most places.
I agree with you, however the access he has also gives the possibility to find exploits that don’t need access to the device and i think that is an important note to take.
There’s always ways to endure running secure software.
Video title: I Hacked This Amazon Router. What I Found Should be Illegal.
Goes on to exclusively reproduce CVEs other people published.
I mean youre kinda right, but keep in mind they have to get views and make money somehow, and this guy makes valuable and education content overall.
I believe you missed the point. Hard-coded passwords should be illegal, not router hacking.
My point was that, contrary to the video’s title, he hacked jack squat, and found only things other people found for him, but managed to squeeze a clickbait video out of regurgitating CVE descriptions. Before “Youtuber”, we had a different name for that.
Care to elucidate?
I believe you missed the point. The video author didn’t find anything, they just reproduced what others had done before them.
TIL “merely poking a file” means sending an HTTP request