Today I went to go & reset my router, but forgot the account password for the ISP. On the (extremely) off-chance of the password being present in the 'Password' field, I went to the appropriate page of the router's configuration settings (which is not secured using HTTPS) & found that the password had been blanked with dummy-characters (••••).
However, on viewing the page source the password is fully viewable, of which it's essentially this:
<input type="password" name="Password" value="SDrtdF">
obviously that's not my password, and I've also changed a couple of aspects of the HTML element to minimize exploitation
The input value of the password field is provided by the router, and not by the browser (I don't use autofill or tools to remember passwords). For this example, the real password is
SDrtdF, which is the value of the password field.
This essentially means that anyone who has access to the router* can easily retrieve the password for the account that connects to the ISP, and use it elsewhere for illegal means. Knowing how some ISPs can be (mostly denying there is a problem, taking a week to realise what the problem is, etc), the first the victim may know about it is when the ISP cuts them off and/or the Police come knocking on their door.
*if a computer on the network is infected with malware & if said malware sends back a copy of the source of every page visited, no 'physical' access to the router would be required.
It's a common practice on websites to use 'dummy' input in password/sensitive fields. Browser autofill doesn't even put the passwords in 'plain sight' like this.
It's obvious that the ISP password is supposed to be hidden (else, why denote it as a password field in the first place if the password is supposed to be visible?).
Should such a vulnerability be taken seriously? Is it worth making the router manufacturer aware (I'd say yes, since their other routers may also carry the same vulnerability?
N.B: I've already made the manufacturer of the router aware of this, and I'm not going to disclose the manufacturer or the model of the router until/if this is fixed, for safety of the vulnerable routers.