1

When I got to 192.168.0.1/login I am greeted with my router login page and can go change some settings. Now let's say I still have the factory default login something like "admin", "admin".

Can an attacker exploit this even while not connected to my network? Does this only pose a risk if an attacker knows my wifi password first?

Improve this question
0

3 Answers 3

Reset to default
2

If an attacker gets access to a computer on the network (malware, remote code execution, uninformed user giving remote access, etc) getting access to the router may be the next step in escalation.

For example they may be able to configure a VPN which gives them broader access to the network. Or they may use it to install malware on the router itself.

Keeping access to an infected network is important for ongoing attack and a router is a fantastic way to do that.

Improve this answer
1
  • As an example of gaining code execution from within the network, consider visiting a website with some browser within the network, where the website hosts attacker-controlled JavaScript code.
    – amon
    Nov 3, 2022 at 0:28
1

In addition to what has already been said, many router are vulnerable to CSRF and or DNS-rebinding attacks. This means that a malicious remote web server (outside of your LAN) can trick your local browser (inside your LAN) to issue HTTP request against the router. This is especially problematic for HTTP endpoints which are not protected (eg. UPnP endpoints) or are protected using default (or weak) credentials.

References:

Improve this answer
0

Why does having default router credentials pose a risk?

Default credentials mean that anyone knows them and can use them to gain access to the device. This is bad enough, let alone if they provide admin level access.

Assuming you meant a home DSL wireless router, a router is usually a device that combines a switch (can jack in a couple of computers, usually 4), DSL gateway (connects to the ISP through your phone line), WLAN (WiFi network) and some other, optional, functionalities (DNS resolution, DHCP server, firewall etc).

As such, here are a couple of things that an attacker could do with admin access to your router:

  • she could configure your DNS server - this may result in her being able to steal credentials by setting up fake sites and fooling you into thinking that they are legit
  • she may be able to whitelist a MAC address to your WiFi (if you have MAC filtering enabled) and, along with the WiFi password that she can probably see, allow herself into your wireless network
  • she may setup dynamic dns so that there's no need to discover your IP everytime she wants to connect to your network from a distance

Can an attacker exploit this even while not connected to my network?

Usually the credentials are only useful if they can be used on the device which they refer to, which also implies access to the device. However there are cases where direct access to the device is not required (see ysdx's answer)

Does this only pose a risk if an attacker knows my wifi password first?

No. An attacker may first gain access to any other device in your home network (e.g. your personal computer) and then access the router

Improve this answer
5
  • "No. The credentials are only useful if they can be used on the device which they refer to, which also implies access to the device - hence a connection to your network" This is not always true. CSRF and DNS rebinding vulnerabilities are often found in routers which makes it possible for a remote wen server to exploit a local browser to target the router (see my answer for details and references).
    – ysdx
    Nov 9, 2022 at 10:16
  • @ysdx good point. I've amended my answer to address your comment.
    – Spyros
    Nov 9, 2022 at 10:30
  • @ysdx although now that I think of it, the credentials per se require direct access to the device in order to be used. Any other token that is exchanged between the router and the browser, that represents a proof of authentication and that can be exploited by all indirect methods, is not technically credentials. Still, good point.
    – Spyros
    Nov 9, 2022 at 11:03
  • What I meant is (for exemple), if your router is vulnerable to DNS rebinding attacks, the attacker can use the local browser to (try to) login on the router (using default/weak password) and then do privileged actions on the router
    – ysdx
    Nov 9, 2022 at 17:22
  • @ysdx yup. makes sense.
    – Spyros
    Nov 9, 2022 at 17:24

Not the answer you're looking for? Browse other questions tagged .