I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of the hall so I connected with my phone (now I think about it, I don't recall seeing the free wi-fi logo). The fact that the SSID of NETGEAR was the default that many routers are shipped with didn't go unnoticed by me, so I found the gateway IP, connected with safari, and out of curiosity, tried the default username and password for the majority of netgear routers - it let me in to the admin console.
I guess I shouldn't have tried to log in to the admin console without the owner's permission, but I feel I should let them know that they are vulnerable, and should change the password from default. I could perhaps make up a story that I thought I was connected via VPN to my router at home, but the connection had failed, or some such rubbish, but I'd rather not lie.
What should I do? Should I just forget it because I shouldn't have tried to gain access? Should I tell them the truth because I didn't do anything malicious?