Default router passwords: the pattern is not the weakness
A visible password pattern does not make a 14-character router key practical to brute-force. Predictable generation and credential reuse are the failures that turn a sticker into access.
This report audits a 2023 question about a factory Wi-Fi password made from five lowercase letters, four digits and five lowercase letters. The format is large enough to resist direct exhaustive search. The documented failures occur when a manufacturer derives the password from public device data, selects from a small dictionary, or reuses the same secret for router administration.
Published by
Ryan James York
Founder, SSX360
Report 001 is defensive desk research based on document review and reproducible arithmetic.
1,411,670,956,533,760,000
candidates in the reported 5-4-5 format
60.3 bits
calculated format entropy
about 17,700 years
full-space exhaustion at the cited RTX 4090 rate
10 of 40
tested routers reused the Wi-Fi password for administration
01 | Six findings
Read the decision record before the detail
The expanded evidence review produced six findings. Each card states what the record supports and keeps source class, scope and uncertainty visible.
Finding 01
The mask is not the weakness
The reported 5-4-5 layout removes about 5.5 bits from a full 14-letter space. It remains a 60.3-bit search problem, not a practical shortcut.
Finding 02
Generation decides the effective space
The documented breaks reduce a nominally large password to public identifiers, weak generators or small candidate sets. Character count alone does not measure that risk.
Finding 03
Community catalogues are not assurance registries
Several public lists catalogue formats and reconstructed generators. In the sources reviewed, none operates as a maintained, vendor-coordinated registry suitable for procurement evidence.
Finding 04
Regulation now addresses the generator
UK rules require relevant passwords to be unique per product or user-defined and restrict derivation from public information and product identifiers.
Finding 05
Mass exploitation follows management access
The scaled incidents in this source record concern administrative credentials and exposed services. The review did not identify a comparable campaign built on recovered factory Wi-Fi passwords.
Finding 06
Credential reuse creates the persistence bridge
Ten of 40 routers in one peer-reviewed study reused the Wi-Fi password for administration, turning network access into a possible management path on those tested devices.
02 | Direct answer
The proposed pattern remains a 60.3-bit space
The reported format contains 10 lowercase positions and four numeric positions. Its size is 26^10 x 10^4, or 1,411,670,956,533,760,000 candidates. A full 14-character lowercase space is 26^14. Knowing the letter and digit positions cuts that larger space by 45.7x, which removes about 5.5 bits rather than changing the feasibility class.
A community-published Hashcat benchmark measured WPA-PBKDF2-PMKID+EAPOL at 2.5333 MH/s on one stock RTX 4090. At that rate, full exhaustion of the reported format takes about 17,700 years. This is a comparison benchmark, not a forecast for a specific password or attacker. Actual time depends on the device format, implementation, hardware and whether the generator has a separate weakness. [S1]
| Format | Candidates | Entropy | Full exhaustion |
|---|---|---|---|
| 5 letters + 4 digits + 5 letters | 1,411,670,956,533,760,000 | 60.3 bits | about 17,700 years |
| 14 lowercase letters | 6.4510 x 10^19 | 65.8 bits | about 807,000 years |
Log-scale comparison
Pattern size and effective generator space are different measurements
14-character alphanumeric
14-character lowercase
16 hexadecimal characters
Reported 5-4-5 mask
10 hexadecimal characters
8 uppercase letters
10 numeric digits
8 hexadecimal characters
Published 2^31 generator reconstruction
Belkin public-identifier derivation
03 | Failure modes
Documented breaks collapse the generator, not the typography
Historical router failures share one property: the printed password looked unique while the process behind it exposed a much smaller secret. Character count alone did not describe the effective keyspace.
Public identifier derivation
CVE-2012-4366 records affected Belkin routers generating the default WPA2 passphrase from eight digits of the WAN MAC address. Beacon data exposed the input needed to predict the credential. [S2]
Weak generation algorithms
Researchers at Radboud University analyzed default WPA2 generators used in widely deployed Dutch routers and documented practical recovery after the effective spaces were reduced. The study treated the generator as the security boundary, not the visible password length. [S3]
Credential reuse inside the router
A 2024 peer-reviewed study tested 40 routers from 14 brands. It found 10 routers that used the Wi-Fi password as the default administrative password. The researchers reported 30 exploitable vulnerabilities to vendors across the wider study. [S4]
Universal administrative credentials at scale
Mirai reached a measured peak of 600,000 infected devices. The peer-reviewed study records a dictionary of 62 username-password pairs and primarily targeted cameras, DVRs and consumer routers. That incident concerned exposed administrative services, not recovery of Wi-Fi passphrases. The distinction matters when prioritizing remediation. [S5]
A community catalogue exists, but not an assurance registry
The Hashcat community has maintained a long-running thread of default router keyspaces and reconstructed generators since 2016. Two smaller public projects separately catalogue SSID families, formats and estimated keyspaces. Together they show that the proposed artefact is feasible at small scale, but their entries remain community assertions until a model is tested or supported by vendor documentation. [S10] [S13] [S14]
What exists
Public lists, per-model research, reproducible arithmetic and responsible disclosure records provide useful raw material.
What remains missing
The review did not identify a maintained, vendor-coordinated registry with current firmware scope, source grading and a corrections process.
Threat scale and proximity are different classes
Predictable factory Wi-Fi passwords are a real, local and proximity-bound risk. The scaled campaigns in this report's source record instead use exposed management services, administrative credentials or unpatched vulnerabilities. The sources reviewed did not identify a comparable criminal campaign whose entry vector was recovery of a patterned factory Wi-Fi password. That is a bounded literature finding, not proof that no such incident has occurred.
04 | Security baseline
Current baselines describe the generator directly
The UK PSTI regime requires relevant passwords to be unique per product or defined by the user. A unique password must not be based on incremental counters, public information or product identifiers unless an accepted encryption or keyed hashing method protects the derivation. The regime has applied since April 29, 2024. [S6] [S11]
ETSI TS 103 848 applies the same direction to home gateways: preconfigured Wi-Fi and administrator passwords must be unique per gateway. NIST IR 8425A publishes a consumer-grade router profile for cybersecurity outcomes, while California law treats a unique preprogrammed password or a required first-use credential change as a reasonable authentication feature for covered connected devices. [S7] [S8] [S9]
The EU Cyber Resilience Act adds a separate reporting timeline. Article 14 reporting for actively exploited vulnerabilities and severe incidents applies from September 11, 2026; the regulation's main product requirements apply from December 11, 2027. This report does not treat that future secure-by-default baseline as a password-specific certification claim. [S12]
These references are evidence mapping, not a certification claim. This report does not determine whether a specific product or manufacturer satisfies a legal or standards-based obligation.
05 | Actions
Test the credential lifecycle, not the label format
For manufacturers and providers
- Generate each device credential from a cryptographically secure random source.
- Keep Wi-Fi, local administration and remote support credentials separate.
- Exclude serial numbers, MAC addresses and visible SSID data from reversible derivation.
- Require a first-use change where a preconfigured secret cannot meet the product threat model.
For operators and buyers
- Change the router administration credential during setup.
- Use a distinct Wi-Fi passphrase and confirm guest networks cannot reach management.
- Record the firmware support period and apply updates through the supported mechanism.
- Ask the supplier how factory credentials are generated, reset and separated by function.
06 | Method and limits
What this report establishes
- The supplied research packet was checked against its cited evidence record. Only claims traceable to a source or reproducible calculation were promoted into the findings. Live counters, unresolved vendor attribution and unsupported incident totals were excluded.
- The keyspace and entropy figures are SSX360 calculations from the stated character sets. The time comparison divides that space by the published RTX 4090 benchmark rate. It is not an SSX360 hardware measurement.
- The original April 2023 forum post is no longer publicly retrievable. The exact router brand behind the 5-4-5 report remains unresolved, so this report makes no vendor attribution from that pattern.
- Historical vulnerabilities describe the models and dates in their sources. They do not establish that a current product remains affected.
- Report 001 used document review and reproducible arithmetic. Its scope excluded interaction with router hardware, network services, wireless exchanges and credentials.
07 | Sources
Evidence record
- S1Community measurementRTX 4090 Hashcat v6.2.6 benchmark
Chick3nman, GitHub Gist | October 14, 2022
- S2PrimaryCVE-2012-4366
NIST National Vulnerability Database | November 19, 2012; record updated June 16, 2026
- S3Peer reviewedScrutinizing WPA2 Password Generating Algorithms in Wireless Routers
USENIX WOOT 2015 | August 2015
- S4Peer reviewedExposed by Default: A Security Analysis of Home Router Default Settings
ACM AsiaCCS 2024, author copy | July 2024
- S5Peer reviewedUnderstanding the Mirai Botnet
USENIX Security 2017 | August 2017
- S6PrimaryThe UK Product Security and Telecommunications Infrastructure regime
GOV.UK | Effective April 29, 2024
- S7PrimaryCyber Security for Home Gateways, ETSI TS 103 848 V1.1.1
ETSI | March 2022
- S8PrimaryRecommended Cybersecurity Requirements for Consumer-Grade Router Products, NIST IR 8425A
NIST | September 2024
- S9PrimaryCalifornia Civil Code section 1798.91.04
California Legislative Information | Effective January 1, 2020
- S10Community referenceKeyspace List for WPA on Default Routers
Hashcat Forum | 2016 to 2024
- S11PrimaryPSTI Security Regulations 2023, Schedule 1
UK Legislation | Effective April 29, 2024
- S12PrimaryCyber Resilience Act reporting obligations
European Commission | Reporting applies from September 11, 2026
- S13Community referenceWifi-WPA-Keyspace-List
sheimo, GitHub | Last updated September 2017
- S14Community referenceSSID keyspace table
n0kovo, GitHub | March 2022
Corrections and contact
Send a source correction to mission@ssx360.com. We amend the report on this URL and record the change on the corrections page.
Reviewing a router fleet, connected product or supplier evidence pack? Request a scoped conversation.
Permanent link | https://ssx360.com/research/001 | Published by Ryan James York