0

Recently I started having issues with my home Wi-fi connection. My devices showed as connected to the router, but no Internet was coming through.

While trying to log into the router through my browser (at 192.168...), I found my password no longer worked. It was reset to the default password written on the side of the device. Note that settings such as my password for connecting devices to the Wifi was not reset. I did not use a paperclip to reset the modem.

While on the phone with my ISP's customer support, the agent thought the device was one rented out by the ISP, though I clarified it is my own device. Is it possible the agent could remotely reset the password on the router, without knowing what my own password was?

Otherwise, is a reset password a sign of a security breach? If so, what additional signs should I look for?

Improve this question
5
  • 2
    99% of all home routers are absolute garbage. I wouldn't be surprized if the password was reset by yelling at it. But it might as well be a security breach.
    – user163495
    Jul 14, 2021 at 14:10
  • Was it just the password or did the whole thing get reset? Would you be able to know?
    – schroeder ♦
    Jul 14, 2021 at 15:43
  • Provided the router is also the modem, it would not be surprising if the ISP did a mass upgrade in silence, without bothering to notify customers. Have you checked in the interface if there are any logs by any chance ? If needed the manual for your model should be available for download from the manufacturer. Another possibility is that the password was not saved to persistent storage, and reverted to factory settings after a power reset (running config != saved config).
    – Kate
    Jul 14, 2021 at 18:22
  • @shroeder All I could tell was that the password was reset. Some settings, I know I customized, such as "Wifi password" and "guest password", and these customized settings were still in-tact. There are plenty of settings in the router that I don't understand, so left alone, and have no way of knowing if they were changed.
    – Village
    Jul 14, 2021 at 19:51
  • @Anonymous There was a recent power failure, and the router/modem isn't attached to any UPS device, but the password to the router/modem was reset, not other settings. I'd think if it had a reset, some of my custom settings would have disappeared.
    – Village
    Jul 14, 2021 at 19:52

1 Answer 1

Reset to default
1

For a compromised router, you want to check:

  • added users
  • added MAC rules
  • added port forwarding rules
  • added or changed firewall rules
  • changed DNS settings
  • remote admin interface turned on

But I would rule out a device fault or a full device reset before assuming a breach.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .