From TechRadar · · 1m 40s
The £3 Wi-Fi extender with a secret admin account
A security researcher pulled apart a bargain Temu extender and found a hidden login that every single unit shares.
In brief
A security researcher pulled apart a bargain Temu extender and found a hidden login that every single unit shares. A hardcoded password baked into firmware is nothing like a default password: you cannot see it, cannot change it, and neither can anyone else who owns the same device. Originally reported by TechRadar.
A bargain worth three pounds
Keiran Smith, a researcher with a penetration-testing certification, bought a six-antenna Wi-Fi extender off Temu after a targeted ad. Then he opened it up.
Cheap chip, extracted firmware
Inside sat a MediaTek MT7620, the workhorse processor of low-cost networking gear. Smith pulled the firmware off the device and started reading.
A hidden admin account
The firmware carried a second administrator account with full control over the device, invisible to anyone using it normally. Its password was fixed in the code.
Same key, every unit
Because the password is a compile-time constant rather than something derived per device, every extender running that firmware opens with the same credentials.
“This one is a compile-time constant rather than something derived from the MAC address or serial number, so it is identical on every unit ever sold.”
You cannot turn it off
Changing the visible admin password leaves the hidden account untouched. Smith found that even edits made by skilled users could vanish after a reboot.
“A default credential is something the owner can see, is told about and can change. What we have here is the opposite on every count.”
Reachable from anywhere
A remote login service accepted those concealed credentials, so an attacker never needs to touch the box. Smith also found command injection and weak update protection.
Sloppy, not necessarily sinister
Smith says this may be leftover factory test access rather than a deliberate backdoor. Either way, the buyer sees the price and none of the software decisions behind it.
The takeaway
A hardcoded password baked into firmware is nothing like a default password: you cannot see it, cannot change it, and neither can anyone else who owns the same device.
