Tutorial - Default Router Password

##
Default Router Password

Created 8/22/01

### Impact

A remote attacker could gain access to the router, allowing him or her to cause a denial of service, change the configuration, install malicious firmware, or gain unauthorized access to the internal network.

### Background

Routers and other networking devices often contain administrative interfaces to allow the network administrator to make configuration changes or diagnose problems remotely. The Telnet, `FTP`, and `HTTP` protocols are commonly used to provide such interfaces. It is usually necessary to provide a password in order to access the device.

### The Problem

Some devices are shipped with known default passwords. If these devices are installed in an operational environment with the default passwords still in place, they provide a remote attacker with an easy way to gain access to the device. Once access has been gained, the attacker could create a denial of service, make unauthorized configuration changes, install malicious firmware, or route packets to machines on the internal network which would otherwise be blocked by the router.

### Resolution

Change the password to something other than the default. A recommended password would be one which is at least eight characters long, contains both letters and numbers, and is not based on any associated information such as account names, user's names, or DNS names.

### Where can I read more about this?

Walter Belgers' paper, UNIX password security, is a good reference on strengthening passwords. Although it focuses on UNIX, the password guidelines presented in this paper are applicable to all devices.

The default password vulnerability in ZyXEL Prestige routers was posted to Bugtraq.