What the research found
A 2024 study built a detailed threat model and tested 40 commercial home routers across 14 brands, examining 81 default settings and behaviors on each one. The researchers reported 30 exploitable vulnerabilities to the vendors. Among the specific issues found: IPv6 devices left exposed due to missing firewall protection, weak Wi-Fi security protocols still active by default, some routers shipping with open Wi-Fi networks or trivial admin passwords built for “plug and play” setup, and firmware update traffic sent without encryption. The researchers also found WPS PIN support enabled on some routers by default, in certain cases paired with a PIN simple enough to guess.
A separate 2025 survey of 392 router owners across multiple countries found the human side of this problem runs equally deep. An estimated 91% of participants’ routers were still running default settings, and while most people did change their default password at setup, a real share admitted to coping strategies, like writing the password down somewhere accessible, rather than managing it well.
Why “default” doesn’t mean “safe”
A router shipped for easy setup is built for one thing: getting a new user online in a few minutes without a support call. Security and quick setup pull in opposite directions almost by design, since most of the meaningful security choices (a unique admin password, disabling unused remote features, updating firmware) need a step beyond plugging the device in and following the on-screen prompts. Manufacturers know this, which is part of why the survey researchers argue the responsibility belongs with safer factory defaults, not with user behavior alone. But until that shift happens across the industry, the gap between what ships and what’s safe sits with whoever sets the router up.
The practical takeaway
Change the router’s admin password from its factory default, not the Wi-Fi password alone, since the two are often confused and the admin panel controls far more. Check whether WPS is enabled in your settings and turn it off if you don’t use it, since it’s a known weak point. Update your router’s firmware through its admin interface rather than assuming it updates on its own, since many models don’t. If your router is several years old and no longer receives firmware updates from the manufacturer, that’s a concrete reason to replace it, not a vague upgrade urge.
This research tested specific router models available at the time of the study. Individual vendors patch specific flaws once notified, so a router named in this research may have since received a fix. The broader pattern (that factory defaults across the industry lean toward convenience over security) holds regardless of any single model’s current patch status.
References
Ye, J., de Carné de Carnavalet, X., Zhao, L., Zhang, M., Wu, L., Zhang, W. “Exposed by Default: A Security Analysis of Home Router Default Settings.” Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, 2024. https://dl.acm.org/doi/pdf/10.1145/3634737.3637671
Ye, J., et al. “Understanding Home Router Configuration Habits & Attitudes.” Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems. https://doi.org/10.1145/3706598.3714231
Top comments (0)