My home network Edimax AR-7084gB ADSL modem/router with firmware verison 184.108.40.206(RUE0.C2A)220.127.116.11 was exploited from WAN few days ago. The attacker changed DNS server settings - primary server to 18.104.22.168 and secondary to 22.214.171.124. The first DNS server served a trojan virus (detected as Crypt3.NRM by AVG) via a fake Adobe Flash update page. My location is Czech Republic and media reported about the modem exploit with similar DNS settings so this was quite now common in my region.
I swapped the modem for a different one in the meantime (Siemens CL-040-I) which hopefully will not be compromised anytime soon. My question is what should I do in long term to prevent similar attack on the modem side? Sure I could set manual DNS server on all PCs but I dont want this because of administrative inconvenience. Will a common inexpensive brand new SOHO modem have a secure enough firmware to prevent most of the usual exploits? Are there any modem WAN security rankings that I could use then looking for new modem brand and model?
I updated firmware on the Edimax to version 126.96.36.199 (dated 2010-12-08, original version dated probably to 2007/2008) but I am not sure if that will be enough to prevent the exploits. Before the attack the modem had a custom weak password and with WAN administration disabled.
Edit: I realized that my WAN administration was enabled, because it is enabled in the factory settings (probably of all historical and current devices with Trendchip Front End since this Front End still ships with TP-Link or Edimax !!!) Such a factory settings is unbelievable... One has to explicitly forbid that in a custom Access Management setting. I guess most users won't do this after purchase anyways and thus reveal their login page into the public internet...
I also found the chipset type of the modem here (see "Specifikace"):
CPU: Trendchip TC3162P2
Front End: Trendchip TC3085 (web admin)