Can someone without the WiFi login and no physical access to a router still access it with the admin login?

Question

If you have a router with default login and password for the admin page, can a potential hacker gain access to it without first connecting to the LAN via the WiFi login?

Answer 1

This may be possible using cross-site request forgery. In this attack, the attacker triggers a request to your router, for example by including an image on his site:

<img src="http://192.168.1.1/reboot_the_router?force=true">

When a user visits his site, this triggers a request to the router.

The attacker's site can trigger requests, but not view responses. Not all routers are vulnerable to this. Setting a non-default password certainly protects against CSRF¹.

There are plans to block such requests in the browser, but these haven't been implemented yet.

Edit 1: Setting a non-default password protects against CSRF in some cases. The attacker can no longer forge a request to login using the default credentials. However, if you are already logged in to the router he can use your current session.

Answer 2

Almost all routers are configured by default to only expose the administration interface to the "LAN" side and not to the internet. Some routers have the option to enable or disable this, so it would be good to check the settings of your router.

You can also test this using an online port scanner or this ShieldsUP! tool. These will check if they can access anything on your router from the internet.

Answer 3

Yes, easily.

There are a variety of ways an attacker can gain access to said router. Here are some attack vectors I have on top of my head:

Cross-site Request Forgery

Basically, your browser is connected to LAN. If you browser a page hosted on the attacker's server, then your browser is connected to it as well. Therefore, through your browser, the hacker can access your router admin page. Whether the hacker can get a response depends on the specifics of the implementation.

It is even easier if "browser" is replaced with "executable file".

You may refer to Sjoerd's post for technical details.

Exposed Admin Page

Many routers have the option of enabling external access to the admin page, in addition to internal access.

For example, your router has external IP 8.8.8.8, while internal IP is 192.168.0.X. If external access is enabled, anyone on the internet can type http://8.8.8.8 and see your router's admin login page.

This option is disabled by default.

VPN

VPN is another feature included in most home routers. The purpose is to allow you to access your home network from outside. By definition, you can connect the router's admin page once you're VPN connected.

VPN is likely disabled by default.

Answer 4

• If your computer is infected with malware, the attacker may already have remote access and thus be inside your home network without him even knowing whether you are using cable LAN or WLAN on this particular computer. (He needs some assistance from you, like opening an email attachment or visiting a website that uses a zero-day exploit for your browser. But social engineering is a common door opener for hackers to make you do them this favour.)
• The same applies to vulnerable mobile phones (e.g. an old Android for which no fixes are supplied any more), because they may have been infected in a public place - lets say, an unencrypted airport WLAN.
• Unfortunately, there may be IoT devices that will most likely never get any software update. If a smart light bulb accepts commands via Bluetooth as well as WLAN and somehow allows to be injected code, it may be updated with a modified firmware from outside your house, and then used as a bridge into your home network.

Answer 5

This is also possible via DNS Rebinding. The attack is explained in detail in this article but in short, if you visit a malicious website (or a website with malicious code, such as in an ad or XSS) it can essentially trick your browser into making a request to your router, on your local network, allowing the attacker to make changes remotely.

Some relevant quotes;

...historically, network routers themselves are some of the most common targets to DNS rebinding attacks... 

There are two common attack vectors that I’ve seen with DNS rebinding:

1. POSTing default credentials to a login page like http://192.168.1.1/loginto own router admin. Once the attacker has authenticated they have full device control and can configure the network as they please.

2. Using a router’s Internet Gateway Device (IGD) interface through UPnP to configure permanent port forwarding connections and expose arbitrary UDP & TCP ports on the network to the public Internet.

From what I understand this requires a bit of setup, and is specific to the interface your dealing with (i.e. one javascript script isn't going to work against every router interface). DNS Rebinding isn't limited to routers as you'll read in the article.