1

This applies to spectrum provided modem/wifi router Ubee. My wifi router's client list showed unknown devices. So I changed the password. These unknown devices were still connected (via wifi, not ethernet). And even known devices, which I have not yet been told the new password were still listed in the client list. Rebooting the router or refresh-client-list did not change anything. How can this be?

2

I'm not particularly familiar with the router model you're working with, but I can think of two possibilities for why this might be, without a vulnerability in the router being involved.

DHCP Leases

One Possibility is that the Client List you're referring to is generated using DHCP Leases. In this case, the device might not actually be connected - just listed for historical reasons.

To summarize (very briefly), a DHCP Lease enables a device to keep the same IP Address on the network as long as the device continues to renew it's association with the network before the Lease expires.

DHCP Leases are usually associated with a few properties of the device, on a list stored by your router. These properties are:

  • MAC Address (this is usually like the primary key - even if the hostname changes the device will still get the IP Address if the MAC matches)
  • Hostname
  • Expiry
  • Last time the device was connected

So even though you've changed the WiFi password and rebooted the router, the router may have kept the existing Lease list so that when devices reconnect it can remember their IP Addresses.

Guest Network(s)

Another possibility is that the device is connected to a Guest Network. The Guest Network may have a different password - or no password at all. This would leave the device's connection settings unaffected if you change the password on the main network. In this case the device would actually be connected to the WiFi, but would normally not have access to any of the devices on your main (non-guest) network.

Check the device settings for a way to disable guest networks if this is the case. Or you may be able to assign a different password to the Guest Network.

Other Possibilities

Without going into too much detail on these, here's some wild possibilities to look at for diagnosing this issue:

  • Router Bugs (get latest firmware, check with manufacturer for known issues)
  • Another WiFi access point connected with Ethernet to your main router. Possibly a range extender? The device may be registered with DHCP to your main router, but connected to a different WiFi Access Point.
  • If the device you're referring to is a Phone - and a device linked to an account that shares the Phone's KeyChain was already updated - the device could have synced the new password via the system's KeyChain over cellular data. My iPhone does this when I update the password for my network on my MacBook. Could also happen with ChromeBook and Android or two Android devices.
  • Common for people working in development or IT: If you have Virtual Machines running on your computer (VMWare, VirtualBox, Parallels, Windows Hyper-V, etc.) and the VM is connected in "Bridged" mode, it will acquire a DHCP lease with your router under a virtualized mac address, without needing the WiFi password. The VMs would operate on a low level of the network without being aware of the physical network device on the host machine, because the virtualization software would provide a "virtual" network card.
  • After doing a little research on the device line, it looks like something probably provided by your ISP. If the devices are definitely in a "Connected" state on the network (ie. The admin panel shows when it was last connected and it is current), then try going through common problematic WiFi features like disabling WPS. If you still have issues after that, and you've exhausted the above... I'd disable the WiFi on this device and buy your own device to service as the WiFi access point for your network. – nbering Sep 16 '18 at 20:34
  • ARP tables? idk i'm a bit sleepy right now. – Azteca Oct 15 '18 at 3:15
0

While there is not certain way to tell without detail description of your setup, sounds like some of the high-end OSs have shared password details with your lower-end devices (not necessarily an attack). Please, provide more details about the model of the router, the devices that actually know your password as well as the devices that you see connected without giving the password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.