The Office Router Still on Its Factory Password

The box on the shelf

Somewhere in the office, usually on a shelf or behind the front desk, a small box with blinking lights runs the internet for everyone.

It was installed with the internet service years ago. Its label carries the network name, the Wi-Fi password and, often, the login for its settings page.

In many offices all three are still exactly as they came out of the box, and the software inside has never been updated.

Which means anyone who can read the label, or look up the model, may be able to change the device every computer in the office depends on.

Two passwords, not one

A router has two separate passwords, and most people only know about one.

The Wi-Fi password lets a device join the network. It gets shared with staff, contractors and visitors, and ends up on whiteboards and sticky notes.

The admin password opens the router's settings page, usually reached by typing an address such as 192.168.0.1 or 192.168.1.1 into a browser on any connected device.

Factory admin logins are often identical for every unit of a model and printed in manuals anyone can download. Some are as simple as admin and password.

What someone could change

• The DNS setting, quietly sending the office to the wrong servers.
• Port forwarding, exposing office devices directly to the internet.
• Remote administration, letting them back in from anywhere.
• The Wi-Fi password, locking staff out.
• The admin password itself, so nobody else can undo the rest.

The first is the one nobody would notice. DNS is the internet's address book, and a router pointed at a stranger's server can send every computer in the office to convincing copies of the sites staff use.

Changing the admin password

Log in to the settings page with the current details, find the administration or management section, and set a long password used nowhere else.

Keep it with the business's other important logins, not on a note stuck to the router. Whoever looks after your computers should have it; visitors should not.

If the router came from your internet provider, call them first. Some providers manage their routers remotely and will change settings for you, or expect to.

While you are there, turn off remote administration, sometimes called remote management, unless someone genuinely uses it.

Updating the firmware

Firmware is the software inside the router. Manufacturers release updates that close security holes, and many routers never install them on their own.

The settings page usually shows the current version and may offer a check for updates. Otherwise, the manufacturer's support page lists the latest version for each model.

Update after hours. The router restarts, the office loses its connection for a few minutes, and settings occasionally need checking afterwards.

If the manufacturer stopped releasing updates for your model years ago, replace it. A router costs little compared with what passes through it.

A worked example

A naturopathic clinic with three practitioners and a front desk has a waiting room where patients often sit for ten minutes with their phones.

The router, installed with the internet service four years earlier, sat on a shelf behind reception. Its Wi-Fi password, printed on the label, had been copied onto a card on the counter for patients.

The same network carried the booking computer, the practitioners' laptops with patient notes, and the printer.

When a new office manager went through the setup, she found the settings page still accepted the factory login, the firmware had never been updated, and remote administration was switched on.

Anyone who had waited for an appointment had been on the same network as patient records, one published password away from the router's settings.

The clinic changed the admin password, updated the firmware, switched off remote administration and created a guest network for the waiting room.

The office network got a new Wi-Fi password, and the card on the counter now shows the guest one.

A separate network for visitors

Most current routers can run a second, guest network alongside the main one.

With isolation switched on, guests get the internet and nothing else. They cannot see the office computers, the printer, the shared drive or each other.

Give it its own name and password, and change the password now and then. Guests only need it for the visit, so changing it costs nothing.

Staff phones can go on the guest network too. Few need the office printer, and personal phones carry apps nobody has checked.

Other settings worth a look

Wi-Fi encryption should be WPA2, ideally with AES. The older options, WEP and the original WPA, can be broken with freely available tools.

Turn off WPS, the push-button and PIN quick setup feature. Its PIN can be guessed by automated tools, and few offices use it after the first day.

Check the list of connected devices, and ask about anything nobody can identify. And confirm the DNS setting matches your provider's, or is left on automatic.

Who should do this

None of this takes long, but it does need someone comfortable in a settings page full of unfamiliar terms.

Whoever looks after your computers or your website can usually do it in an hour, and should write down what was changed and where the new passwords are kept.

If the internet provider manages the router, call them with the list: admin password, firmware, remote access, guest network. Much of it can be done over the phone.

The counter-case

A router supplied and managed by the internet provider, updated remotely, is in better shape than one bought at a shop and forgotten. Its admin password and guest network still deserve a check.

A one-person office with no visitors and nothing sensitive on the network has less exposure, though the same half hour of settings still applies.

And an office whose network is run by an IT company should ask them to confirm each point rather than logging in to change things.

Everywhere else, change the factory admin password, update the firmware and give visitors their own network.

This afternoon

1. Find the router and note its model.
2. Log in to its settings page.
3. Change the admin password from the factory one.
4. Install the latest firmware after hours.
5. Turn off remote administration and WPS.
6. Set up a guest network for visitors.
7. Change the main Wi-Fi password once guests have moved.

Step three matters most. Every other setting on the list can be changed back by anyone who knows the factory login, so until that password changes, nothing else holds.

The same hunt for forgotten ways in, applied to the website, is covered in FTP accounts nobody remembers creating.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.