nosferatu

nosferatu Windows NTLM/Kerberos Authentication Backdoor How it Works First, the DLL is injected into the lsass.exe process, and will begin hooking authentication WinAPI calls. The targeted functions are: NTLM: NtlmShared!MsvpPasswordValidate Kerberos: cryptdll!CDLocateCSystem Kerberos:...

CVE-2026-11405

CVE-2026-11405 affects multiple Tenda firmware versions where the web server binary /bin/httpd implements a hidden backdoor authentication in login(): after normal MD5-based verification, if authentication fails it reads a config value via GetValue("sys.rzadmin.password") and compares it to the u...