# The £3 Wi-Fi extender with a secret admin account

> A security researcher pulled apart a bargain Temu extender and found a hidden login that every single unit shares.
- Title: The £3 Wi-Fi extender with a secret admin account · TechRadar
- Summary: A security researcher pulled apart a bargain Temu extender and found a hidden login that every single unit shares. A hardcoded password baked into firmware…
- Keywords: security, iot, firmware, temu, networking, technology, Wi-Fi, extender, secret, admin, account, TechRadar
- Source: TechRadar — https://techradar.com/pro/expert-finds-this-gbp3-temu-wi-fi-extender-is-full-of-security-issues-and-definitely-not-the-bargain-youd-hoped-for
- Published: 2026-09-13T10:05:00+00:00
- Read time: 1 min
- Topics: security, iot, firmware, temu, networking, technology
## A bargain worth three pounds
Keiran Smith, a researcher with a penetration-testing certification, bought a six-antenna Wi-Fi extender off Temu after a targeted ad. Then he opened it up.
## Cheap chip, extracted firmware
Inside sat a MediaTek MT7620, the workhorse processor of low-cost networking gear. Smith pulled the firmware off the device and started reading.
## A hidden admin account
The firmware carried a second administrator account with full control over the device, invisible to anyone using it normally. Its password was fixed in the code.
## Same key, every unit
Because the password is a compile-time constant rather than something derived per device, every extender running that firmware opens with the same credentials.

> This one is a compile-time constant rather than something derived from the MAC address or serial number, so it is identical on every unit ever sold.
## You cannot turn it off
Changing the visible admin password leaves the hidden account untouched. Smith found that even edits made by skilled users could vanish after a reboot.

> A default credential is something the owner can see, is told about and can change. What we have here is the opposite on every count.
## Reachable from anywhere
A remote login service accepted those concealed credentials, so an attacker never needs to touch the box. Smith also found command injection and weak update protection.
## Sloppy, not necessarily sinister
Smith says this may be leftover factory test access rather than a deliberate backdoor. Either way, the buyer sees the price and none of the software decisions behind it.
## Key takeaway

A hardcoded password baked into firmware is nothing like a default password: you cannot see it, cannot change it, and neither can anyone else who owns the same device.