The Router in the Closet: How Protected Is the Hardware Your ISP Gave You?

The Router in the Closet: How Protected Is the Hardware Your ISP Gave You?

Somewhere in most small offices, and in nearly every home, sits a router that arrived from the internet service provider, got plugged in on the day service was installed, and has not been touched since. It is the single device every other piece of network security depends on, and it is also, empirically, one of the least secured pieces of hardware most organizations own.

The scale of the problem is not speculative. An academic security analysis of forty commercial routers spanning fourteen brands, examining both default settings and the “deep default” settings that activate once common features are enabled, identified thirty distinct exploitable vulnerabilities: exposed local devices due to missing firewall protection on IPv6 traffic, weak wireless security protocols left active out of the box, unencrypted firmware update channels that could allow a malicious update to be substituted for a legitimate one, and concealed WPS PIN support tied to a trivially guessable PIN.⁹ A separate assessment citing federal research found that more than 65 percent of home routers were still running on default administrator credentials, meaning the username and password printed on the bottom of the device, the first thing any automated scanning tool tries.¹⁰ Internet-scanning tools index millions of such routers directly reachable from the public internet, and automated bots continuously probe for exactly this combination: a router with factory-default credentials still active years after installation.¹¹

ISP-provided routers carry a specific version of this problem beyond what applies to consumer routers generally. Many ship with settings locked at the provider level, meaning the office or household using the device cannot necessarily change everything a security-conscious user would want to change, even after finding the settings menu.¹² Firmware updates, when they happen, are typically pushed by the ISP on its own schedule rather than in response to a given office's risk profile, and there is often no visible way for the end user to confirm a device is current versus quietly running firmware that is years out of date. The device functions as a black box. It works, traffic flows, and there is no obvious signal indicating whether the firewall behind that working connection is doing anything close to what a security-conscious configuration would demand.

None of this means the hardware is useless as delivered. Most ISP routers provide basic network address translation and a stateful firewall that blocks unsolicited inbound connections by default, which handles a meaningful share of opportunistic scanning.¹³ The failures cluster around what happens after that baseline: weak or absent modern Wi-Fi encryption, WPS left enabled, default credentials never changed, no separation between the primary network and every guest device or smart-home gadget that joins it, and firmware that may not have been patched since installation day.

For a small office, the fix does not require abandoning ISP-provided equipment, though placing it into bridge mode behind a dedicated, business-grade router is the more defensible long-term choice where budget allows.¹⁴ Short of that, a handful of changes address the majority of documented risk: changing the default administrator password immediately, confirming WPA3, or at minimum WPA2, encryption is active rather than an older and weaker standard, disabling WPS entirely, and separating guest and IoT devices, smart thermostats, printers, security cameras, onto a distinct network or guest network so a compromised smart device cannot reach the computers handling client data.¹⁵ Each of these takes minutes. None requires replacing hardware. All of them were, in the routers researchers examined, disabled or unaddressed by default.

The uncomfortable truth is that most small offices spend real money on endpoint protection, email filtering, and staff training, while the device every one of those investments depends on for its connection to the outside world sits in a closet, unconfigured, exactly as it arrived. A firewall never reviewed since installation is not a firewall an office can meaningfully claim to have. It is a box that happens to be doing that job by default, for now, until a firmware vulnerability or a scanning bot finds otherwise.

#CyberSecurity #NetworkSecurity #HomeOfficeSecurity #SmallBusinessCyberSecurity #GarlickGroup

9. “Exposed by Default: A Security Analysis of Home Router Default Settings,” Proceedings of the 19th ACM Asia Conference on Computer and Communications Security (2024), https://dl.acm.org/doi/10.1145/3634737.3637671.

10. “WiFi 6 Router Settings: 8 Alarming Security Risks,” Jazz Cyber Shield, May 23, 2026, https://blog.jazzcybershield.com/wifi-6-router-settings-security/.

11. “Home Network Security Guide 2026: Lock Down Your Router, Isolate IoT Devices,” Silent Security, March 20, 2026, https://silentsecurity.net/resources/home-network-security/.

12. Jazz Cyber Shield, “WiFi 6 Router Settings.”

13. “15 Essential Home Network Security Settings to Turn On in 2026,” Vecosys, June 9, 2026, https://www.vecosys.com/home-network-security-settings-2026/.

14. Jazz Cyber Shield, “WiFi 6 Router Settings.”

15. Vecosys, “15 Essential Home Network Security Settings”; and Silent Security, “Home Network Security Guide 2026.”