https://kb.cert.org/vuls/id/213560
The web server binary
/bin/httpdcontains an undocumented backdoor authentication mechanism in thelogin()function. Initially, the function follows a normal authentication path using MD5-based password verification. However, if authentication fails, the function invokesGetValue("sys.rzadmin.password")to retrieve an alternate password value from the device configuration. It then performs a directstrcmp()comparison in plaintext between the user-supplied password and the configuration-stored value. A successful match grantsrole=2admin-level access and creates a valid session.The associated username is not validated, so any provided username will succeed when paired with the backdoor password. This backdoor authentication mechanism is not documented or visible through any administrative interface.
@nyanbinary @cR0w
OK, after a little digging, there are indeed some Tenda firmwares that contain the rzadmin backdoor account in httpd. The problem? Out of the firmware versions that CERT lists, none of them contain this backdoor. Oops. 😂
For example if we look at the httpd from a Tenda G300, we can indeed see a login() function with a GetValue("sys.rzadmin.password") and a subsequent strcmp() to compare.
Maybe I'm simply being pedantic, but I think that when an organization publishes about a vulnerability and creates a CVE for it, the affected products should perhaps be accurate? 🤷♂️
CFP for #OffensiveCon26 Tokyo edition is STILL open.
We're looking for real, original work: cutting-edge security research, novel exploit techniques and deep technical investigations that actually move the field forward.
And yes, AI it's also in the game.
Shared by my Daughter
"I need privacy, not because my actions are questionable, but because your judgement and intentions are"
In response to "if you have nothing to hide you have nothing to fear"
“you couldn’t tell it was slop if I lied” said the same fried brain that thinks “Key Takeaways 🚀” is a feature of a readme any fucking human wrote
IDA 9.4 Beta 1 has been published (with some features of my own on it):
we're hiring one iOS human on my team https://nowsecure.applytojob.com/apply/BXcVGTgFyb/Research-Engineer?source=Our%20Career%20Page%20Widget
Won 80k via kCTF, unpriv userns-reachable vuln: https://lore.kernel.org/linux-cve-announce/2026050859-CVE-2026-43456-ae60@gregkh/ We fixed in March, upstream 6.6 still unfixed 4 months later.
I heard a very encouraging insight from @j00ru many years ago: either everyone has looked at it because there are always bugs, so there will be more, or no one has looked at it, so there will be bugs. In both cases, there are bugs. I welcome the machines to the playing field.
Cortex is a long-term, multi-tenant scalable open source storage for Prometheus and OpenTelemetry.
Earlier this year we conducted a security audit sponsored by @ostifofficial
Check our report here:
https://blog.quarkslab.com/cortex-security-audit.html
So, if I understand correctly, a bunch of elected politicians said ‘okay, we identified that the things Facebook and friends are doing is actively harmful to their users. So what we’re going to do to mitigate this is ensure that, legally speaking, the only people who can experience these negative effects are people of voting age.’