Router Security Vulnerabilities

Typically this means there's either a serious XSS flaw or a default password on your router. Someone could, for example, change your DNS settings and start intercepting your traffic.

Their router admin page and ssh are also open to the internet.

If you're vulnerable to attacks from the LAN, you're vulnerable to your wi-fi router (or your coffee shop/workplace's router) being compromised, which is quite common; see e.g. https://www.bleepingcomputer.com/news/security/mirai-botnet-... and <a href="https://blog.lumen.com

Perhaps they have a zero day telnet client or browser exploit. :)

Compromised routers can be used to compromise devices behind it. Also many devices (like IP cameras) usually have port forwarding to allow the users to access it from outside.

For most users, this device wouldn't be directly exposed to the internet... it would be behind NAT on peoples home WiFi networks.I find it hard to believe that even a critical unpatched vulnerability in the client device could be mass exploited like this.I suspect the "cloud services" are somehow at fault...

good point. i simply meant that the vulnerability can be exploited from the network (with no (initial) root access to the machine) and so almost all of them are.

Your modems already have a backdoor. Your wifi password is stored on their servers and modems already will execute arbitrary code through the management interface.

Plenty of web interfaces on routers have VERY poor security, a bug that gives you access to the web interface may have just given you a shell aswell.

Your understanding is the same as mine. I don't think that's necessarily malicious though. I also don't think it would have to be to 22/23 - do we know that SSH or Telnet were the attack vector? Thinking about general IOT devices, even if it were SSH this time it well be a web UI with RCE next time.