Report 001: Default router passwords: the pattern is not the weakness · SSX360<br>Skip to content<br>Request a callOpen menu≡

Contents<br>01 | Six findings<br>Read the decision record before the detail<br>The expanded evidence review produced six findings. Each card states what the record supports and keeps source class, scope and uncertainty visible.<br>Finding 01<br>The mask is not the weakness<br>The reported 5-4-5 layout removes about 5.5 bits from a full 14-letter space. It remains a 60.3-bit search problem, not a practical shortcut.<br>[S1]

Finding 02<br>Generation decides the effective space<br>The documented breaks reduce a nominally large password to public identifiers, weak generators or small candidate sets. Character count alone does not measure that risk.<br>[S2][S3]

Finding 03<br>Community catalogues are not assurance registries<br>Several public lists catalogue formats and reconstructed generators. In the sources reviewed, none operates as a maintained, vendor-coordinated registry suitable for procurement evidence.<br>[S10][S13][S14]

Finding 04<br>Regulation now addresses the generator<br>UK rules require relevant passwords to be unique per product or user-defined and restrict derivation from public information and product identifiers.<br>[S11]

Finding 05<br>Mass exploitation follows management access<br>The scaled incidents in this source record concern administrative credentials and exposed services. The review did not identify a comparable campaign built on recovered factory Wi-Fi passwords.<br>[S5]

Finding 06<br>Credential reuse creates the persistence bridge<br>Ten of 40 routers in one peer-reviewed study reused the Wi-Fi password for administration, turning network access into a possible management path on those tested devices.<br>[S4]

02 | Direct answer<br>The proposed pattern remains a 60.3-bit space<br>The reported format contains 10 lowercase positions and four numeric positions. Its size is 26^10 x 10^4, or 1,411,670,956,533,760,000 candidates. A full 14-character lowercase space is 26^14. Knowing the letter and digit positions cuts that larger space by 45.7x, which removes about 5.5 bits rather than changing the feasibility class.<br>A community-published Hashcat benchmark measured WPA-PBKDF2-PMKID+EAPOL at 2.5333 MH/s on one stock RTX 4090. At that rate, full exhaustion of the reported format takes about 17,700 years. This is a comparison benchmark, not a forecast for a specific password or attacker. Actual time depends on the device format, implementation, hardware and whether the generator has a separate weakness. [S1]<br>FormatCandidatesEntropyFull exhaustion5 letters + 4 digits + 5 letters1,411,670,956,533,760,00060.3 bitsabout 17,700 years14 lowercase letters6.4510 x 10^1965.8 bitsabout 807,000 years<br>Log-scale comparison<br>Pattern size and effective generator space are different measurements

Direct arithmeticCollapsed generator

1 ms1 min1 day1 year10 kyr1 Myr100 Gyr

14-character alphanumeric

155 billion years<br>14-character lowercase

807,000 years<br>16 hexadecimal characters

231,000 years<br>Reported 5-4-5 mask

17,700 years<br>10 hexadecimal characters

5.0 days<br>8 uppercase letters

22.9 hours<br>10 numeric digits

1.1 hours<br>8 hexadecimal characters

28.3 minutes<br>Published 2^31 generator reconstruction

14.1 minutes<br>Belkin public-identifier derivation

no exhaustive search

Times normalize each candidate space to the cited community RTX 4090 rate of 2.5333 MH/s. Gold bars are direct arithmetic. Coral bars show why the generator must be assessed separately: one published reconstruction reduced a nominal password to a 31-bit seed space, while the affected Belkin design derived the credential from public device data without exhaustive search. The 1 ms Belkin position is a visual floor, not a measured runtime. [S1] [S2] [S10]<br>03 | Failure modes<br>Documented breaks collapse the generator, not the typography<br>Historical router failures share one property: the printed password looked unique while the process behind it exposed a much smaller secret. Character count alone did not describe the effective keyspace.<br>Public identifier derivation<br>CVE-2012-4366 records affected Belkin routers generating the default WPA2 passphrase from eight digits of the WAN MAC address. Beacon data exposed the input needed to predict the credential. [S2]

Weak generation algorithms<br>Researchers at Radboud University analyzed default WPA2 generators used in widely deployed Dutch routers and documented practical recovery after the effective spaces were reduced. The study treated the generator as the security boundary, not the visible password length. [S3]

Credential reuse inside the router<br>A 2024 peer-reviewed study tested 40 routers from 14 brands. It found 10 routers that used the Wi-Fi password as the default administrative password. The researchers reported 30 exploitable vulnerabilities to vendors across the wider study. [S4]

Universal administrative credentials at scale<br>Mirai reached a measured peak of 600,000 infected devices. The peer-reviewed study records a dictionary of 62...