Security issue on new fibre hub.

[#1]

Apparently anyone can log into the router start page when they are connected either wirelessly or via an ehernet socket. It would seem that the internet connection could be disconnected without needing to enter a username or password, just by typing 192.168.1.254 into a browser. Furthermore if this happened it would require a visit to the premises when the operator would normally use remote desktop to access tne security cameras from their home. As we are a public facility hosting various user groups including youth clubs and sports clubs this would appear to be a security breach just waiting to happen. Any ideas? 

[#2]

Only with the use of the router admin name and password. Access to the first pages gives info only, the admin details are needed to change anything.

Presumably the router along with admin details are kept in a secure place?

[#3]

Yes - the router is in a secure place within the building. Although access to the router is limited without having to log in, it is still possible to disconnect from the internet and also view the connected devices including mac addresses on the index page.

[#4]

Which router?

[#5]

@yaxleyph 

Have you actually tried to disconnect using the field in the Status page? On every Hub that I have come across this is there for advice, not operation. To switch it off I have had to log in to the advanced pages.

Yes, you can see connected devices. It’s a matter of opinion if this is a security issue. It certainly won’t be changed any time soon.

[#6]

I don't think you can disconnect - it just looks like a button.

[#7]

Moderators Note

This topic has been moved from Fibre to My Router

[#8]

Hi @yaxleyph 

If you are using a Hub One then when you click on 'Disconnect' it will prompt the user the enter the Hub One password. Same if you click 'Connect' when the Hub One is in the disconnected state. You can change the default password if required.

Yes the Home page does display attached WiFi and Ethernet connections (hostname, MAC address and Assigned IP Address) it also displays the Broadband User name.

If you are concerned about security I suggest you purchase a third party DSL Router which requires a login to view everything, TP-Link devices could be an option.

Dan.