Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Suppose a wifi router has strong admin password, updated firmware and no vulnurability then -
Is the router safe from malware infection from android phones connected to it?
You explicitly state that the router has no vulnerabilities - which means that no vulnerabilities can be used to attack the router. You also state that the admin password is strong - which means that no password guessing should be possible.
This means that the router can only be attacked if the password was made available to the phone, like when logging in to the router from the phone. Or if the router is specifically designed to allow user uploaded code to run on the router, i.e. not a vulnerability but a feature.
Also note that "having no vulnerabilities" is different from "vendor is not aware of vulnerabilities", "no vulnerabilities publicly known" or "latest vendor update is installed". The router might still have unfixed vulnerabilities in these cases and these might also be known and used by attackers.
Can malware from an infected android phone transmit infection to other devices(which are not updated) on same router without any user interaction on either of the devices?
If these devices are vulnerable for such attacks, then this is possible. Routers usually don't provide any protection here, but just forward the network traffic between the devices connected to the router.
Note that the term "router" is not strictly defined though, i.e. there might be devices which include intrusion detection and prevention and/or granular micro-segmentation to actually offer some protection. But this is more in the enterprise world (and usually called firewalls or NGFW or IDS/IPS or similar there - but not router) and not for consumer-grade routers.
