Return to Answer

Add "virtual machines" suggestion.

Source Link

edited Sep 16, 2018 at 20:38

I'm not particularly familiar with the router model you're working with, but I can think of two possibilities for why this might be, without a vulnerability in the router being involved.

DHCP Leases

One Possibility is that the Client List you're referring to is generated using DHCP Leases. In this case, the device might not actually be connected - just listed for historical reasons.

To summarize (very briefly), a DHCP Lease enables a device to keep the same IP Address on the network as long as the device continues to renew it's association with the network before the Lease expires.

DHCP Leases are usually associated with a few properties of the device, on a list stored by your router. These properties are:

MAC Address (this is usually like the primary key - even if the hostname changes the device will still get the IP Address if the MAC matches)
Hostname
Expiry
Last time the device was connected

So even though you've changed the WiFi password and rebooted the router, the router may have kept the existing Lease list so that when devices reconnect it can remember their IP Addresses.

Guest Network(s)

Another possibility is that the device is connected to a Guest Network. The Guest Network may have a different password - or no password at all. This would leave the device's connection settings unaffected if you change the password on the main network. In this case the device would actually be connected to the WiFi, but would normally not have access to any of the devices on your main (non-guest) network.

Check the device settings for a way to disable guest networks if this is the case. Or you may be able to assign a different password to the Guest Network.

Other Possibilities

Without going into too much detail on these, here's some wild possibilities to look at for diagnosing this issue:

Router Bugs (get latest firmware, check with manufacturer for known issues)
Another WiFi access point connected with Ethernet to your main router. Possibly a range extender? The device may be registered with DHCP to your main router, but connected to a different WiFi Access Point.
If the device you're referring to is a Phone - and a device linked to an account that shares the Phone's KeyChain was already updated - the device could have synced the new password via the system's KeyChain over cellular data. My iPhone does this when I update the password for my network on my MacBook. Could also happen with ChromeBook and Android or two Android devices.
Common for people working in development or IT: If you have Virtual Machines running on your computer (VMWare, VirtualBox, Parallels, Windows Hyper-V, etc.) and the VM is connected in "Bridged" mode, it will acquire a DHCP lease with your router under a virtualized mac address, without needing the WiFi password. The VMs would operate on a low level of the network without being aware of the physical network device on the host machine, because the virtualization software would provide a "virtual" network card.

I'm not particularly familiar with the router model you're working with, but I can think of two possibilities for why this might be, without a vulnerability in the router being involved.

DHCP Leases

One Possibility is that the Client List you're referring to is generated using DHCP Leases. In this case, the device might not actually be connected - just listed for historical reasons.

DHCP Leases are usually associated with a few properties of the device, on a list stored by your router. These properties are:

MAC Address (this is usually like the primary key - even if the hostname changes the device will still get the IP Address if the MAC matches)
Hostname
Expiry
Last time the device was connected

So even though you've changed the WiFi password and rebooted the router, the router may have kept the existing Lease list so that when devices reconnect it can remember their IP Addresses.

Guest Network(s)

Check the device settings for a way to disable guest networks if this is the case. Or you may be able to assign a different password to the Guest Network.

Other Possibilities

Without going into too much detail on these, here's some wild possibilities to look at for diagnosing this issue:

Router Bugs (get latest firmware, check with manufacturer for known issues)
Another WiFi access point connected with Ethernet to your main router. Possibly a range extender? The device may be registered with DHCP to your main router, but connected to a different WiFi Access Point.
If the device you're referring to is a Phone - and a device linked to an account that shares the Phone's KeyChain was already updated - the device could have synced the new password via the system's KeyChain over cellular data. My iPhone does this when I update the password for my network on my MacBook. Could also happen with ChromeBook and Android or two Android devices.

I'm not particularly familiar with the router model you're working with, but I can think of two possibilities for why this might be, without a vulnerability in the router being involved.

DHCP Leases

One Possibility is that the Client List you're referring to is generated using DHCP Leases. In this case, the device might not actually be connected - just listed for historical reasons.

DHCP Leases are usually associated with a few properties of the device, on a list stored by your router. These properties are:

MAC Address (this is usually like the primary key - even if the hostname changes the device will still get the IP Address if the MAC matches)
Hostname
Expiry
Last time the device was connected

So even though you've changed the WiFi password and rebooted the router, the router may have kept the existing Lease list so that when devices reconnect it can remember their IP Addresses.

Guest Network(s)

Check the device settings for a way to disable guest networks if this is the case. Or you may be able to assign a different password to the Guest Network.

Other Possibilities

Without going into too much detail on these, here's some wild possibilities to look at for diagnosing this issue:

Router Bugs (get latest firmware, check with manufacturer for known issues)
Another WiFi access point connected with Ethernet to your main router. Possibly a range extender? The device may be registered with DHCP to your main router, but connected to a different WiFi Access Point.
If the device you're referring to is a Phone - and a device linked to an account that shares the Phone's KeyChain was already updated - the device could have synced the new password via the system's KeyChain over cellular data. My iPhone does this when I update the password for my network on my MacBook. Could also happen with ChromeBook and Android or two Android devices.
Common for people working in development or IT: If you have Virtual Machines running on your computer (VMWare, VirtualBox, Parallels, Windows Hyper-V, etc.) and the VM is connected in "Bridged" mode, it will acquire a DHCP lease with your router under a virtualized mac address, without needing the WiFi password. The VMs would operate on a low level of the network without being aware of the physical network device on the host machine, because the virtualization software would provide a "virtual" network card.

Source Link

created Sep 16, 2018 at 20:19

nbering

I'm not particularly familiar with the router model you're working with, but I can think of two possibilities for why this might be, without a vulnerability in the router being involved.

DHCP Leases

One Possibility is that the Client List you're referring to is generated using DHCP Leases. In this case, the device might not actually be connected - just listed for historical reasons.

DHCP Leases are usually associated with a few properties of the device, on a list stored by your router. These properties are:

MAC Address (this is usually like the primary key - even if the hostname changes the device will still get the IP Address if the MAC matches)
Hostname
Expiry
Last time the device was connected

So even though you've changed the WiFi password and rebooted the router, the router may have kept the existing Lease list so that when devices reconnect it can remember their IP Addresses.

Guest Network(s)

Check the device settings for a way to disable guest networks if this is the case. Or you may be able to assign a different password to the Guest Network.

Other Possibilities

Without going into too much detail on these, here's some wild possibilities to look at for diagnosing this issue:

Router Bugs (get latest firmware, check with manufacturer for known issues)
Another WiFi access point connected with Ethernet to your main router. Possibly a range extender? The device may be registered with DHCP to your main router, but connected to a different WiFi Access Point.
If the device you're referring to is a Phone - and a device linked to an account that shares the Phone's KeyChain was already updated - the device could have synced the new password via the system's KeyChain over cellular data. My iPhone does this when I update the password for my network on my MacBook. Could also happen with ChromeBook and Android or two Android devices.