After having changed wifi password the client list shows devices, which do not know yet the new password

Question

This applies to spectrum provided modem/wifi router Ubee. My wifi router's client list showed unknown devices. So I changed the password. These unknown devices were still connected (via wifi, not ethernet). And even known devices, which I have not yet been told the new password were still listed in the client list. Rebooting the router or refresh-client-list did not change anything. How can this be?

Answer 1

I'm not particularly familiar with the router model you're working with, but I can think of two possibilities for why this might be, without a vulnerability in the router being involved.

DHCP Leases

One Possibility is that the Client List you're referring to is generated using DHCP Leases. In this case, the device might not actually be connected - just listed for historical reasons.

To summarize (very briefly), a DHCP Lease enables a device to keep the same IP Address on the network as long as the device continues to renew it's association with the network before the Lease expires.

DHCP Leases are usually associated with a few properties of the device, on a list stored by your router. These properties are:

• MAC Address (this is usually like the primary key - even if the hostname changes the device will still get the IP Address if the MAC matches)
• Hostname
• Expiry
• Last time the device was connected

So even though you've changed the WiFi password and rebooted the router, the router may have kept the existing Lease list so that when devices reconnect it can remember their IP Addresses.

Guest Network(s)

Another possibility is that the device is connected to a Guest Network. The Guest Network may have a different password - or no password at all. This would leave the device's connection settings unaffected if you change the password on the main network. In this case the device would actually be connected to the WiFi, but would normally not have access to any of the devices on your main (non-guest) network.

Check the device settings for a way to disable guest networks if this is the case. Or you may be able to assign a different password to the Guest Network.

Other Possibilities

Without going into too much detail on these, here's some wild possibilities to look at for diagnosing this issue:

• Router Bugs (get latest firmware, check with manufacturer for known issues)
• Another WiFi access point connected with Ethernet to your main router. Possibly a range extender? The device may be registered with DHCP to your main router, but connected to a different WiFi Access Point.
• If the device you're referring to is a Phone - and a device linked to an account that shares the Phone's KeyChain was already updated - the device could have synced the new password via the system's KeyChain over cellular data. My iPhone does this when I update the password for my network on my MacBook. Could also happen with ChromeBook and Android or two Android devices.
• Common for people working in development or IT: If you have Virtual Machines running on your computer (VMWare, VirtualBox, Parallels, Windows Hyper-V, etc.) and the VM is connected in "Bridged" mode, it will acquire a DHCP lease with your router under a virtualized mac address, without needing the WiFi password. The VMs would operate on a low level of the network without being aware of the physical network device on the host machine, because the virtualization software would provide a "virtual" network card.

Answer 2

While there is not certain way to tell without detail description of your setup, sounds like some of the high-end OSs have shared password details with your lower-end devices (not necessarily an attack). Please, provide more details about the model of the router, the devices that actually know your password as well as the devices that you see connected without giving the password.