Hardware Backdoors in Consumer Networking Gear
A writeup on Tenda firmware revealed a hardcoded authentication backdoor in multiple router versions. Tenda makes routers, switches, wireless APs, and video surveillance equipment, and is sold globally. The backdoor value was not disclosed in the article, but a 2022 writeup linked in the thread reveals it. This is not a newly discovered class of problem: Chinese networking hardware with hardcoded credentials has been showing up for years.
What's notable is that the thread treats this as almost expected. The surprise is not that there's a backdoor, it's that someone took the time to document it clearly. The comment about the backdoor value being in a 2022 writeup suggests this has been known and unfixed for at least three years.
For the homelab and self-hosted NAS crowd, which was active in a separate thread about building a minimal ZFS NAS without Synology or TrueNAS, the underlying concern is the same: how much do you trust the hardware running your infrastructure? The NAS thread is full of people choosing NixOS and ZFS precisely because they want to know what is running on their machines.
So what?
If your company uses consumer-grade networking equipment from vendors like Tenda, you should treat those devices as potentially compromised and not put them in any position where they can reach internal services. Segment them. This is basic, but a lot of small teams skip it because the hardware is cheap and the setup is easy.