A £3 Wi-Fi Extender Hides Secret Admin Access

A six-antenna Wi-Fi extender that cost just £3 on Temu has been found to carry a hidden administrator account that ordinary buyers cannot see or remove, according to a security researcher. The device, which was promoted through a targeted ad on the shopping app, reportedly contains a concealed login that remains identical across every unit running its firmware.

The finding, first reported by CyberNews, raises direct questions about what buyers actually get when they purchase drastically discounted connected hardware. It also challenges the common assumption that a cheap extender is simply a cheap extender — a passive piece of plastic and silicon with no deeper access than what the owner configures.

The researcher, Keiran Smith, holds a penetration-testing certification. He bought the extender after seeing it advertised on Temu and then began examining it from the hardware up.

Opening the case, finding the chip

Smith's examination started with the physical device. Inside, he identified a MediaTek MT7620 processor — a chip commonly used in low-cost networking products. That choice of processor is not itself unusual for budget hardware, but it gave him a known architecture to work from.

From there, he extracted the firmware stored inside the extender. That step — pulling the software image off the device and inspecting it outside the normal user interface — is what exposed the hidden access. The account he found carried full control over the extender's functions.

The password for that account was not generated per device. It was embedded directly inside the software as a fixed value, meaning every unit using the same firmware carried the same credentials. The practical result is that one discovered password could unlock the hidden account on any matching device, not just the one in Smith's hands.

Why this differs from a typical default login

Many cheap routers and extenders ship with default administrator credentials — often printed on a sticker or listed in a manual. Those credentials are visible to the owner, and the owner can change them. Smith argued that the distinction matters when assessing how serious this case is.

“It’s worth being precise about what makes this as bad as it is, because ‘hardcoded password’ covers a wide range of sins,” Smith said

— Keiran Smith, security researcher

He described the password as a compile-time constant rather than something derived from a unique identifier such as the MAC address or serial number.

“A default credential is something the owner can see, is told about and can change,” he said. “What we have here is the opposite on every count.”

— Keiran Smith, security researcher

“This one is a compile-time constant rather than something derived from the MAC address or serial number, so it is identical on every unit ever sold.”

— Keiran Smith, security researcher

Changing the normal administrator password through the device's settings would not remove the separate hidden access, according to the findings. Even technically skilled users who managed to discover the account could find their changes disappearing after restarting the extender — a detail that suggests the hidden access is restored by the firmware rather than stored in editable configuration.

Remote login without physical access

The hidden account was not limited to local access. Smith also found a remote login service that accepted the concealed credentials without requiring physical access to the extender itself. That combination — hidden access, credentials that are identical across devices and cannot be changed, plus remote availability — creates a security concern for ordinary owners who would have no way to know the account exists.

Remote reachability matters because it removes the need for an attacker to be on the same network or within physical range of the device. A fixed, shared password paired with a remote service means the barrier to entry is knowledge of the credential rather than any proximity or physical control.

Command injection and update weaknesses

The investigation also uncovered a command injection weakness that could allow attackers to execute unauthorized instructions through the device. Command injection flaws generally let an attacker pass crafted input that the device then runs as system commands — a class of bug that can turn a compromised extender into a foothold for further activity on the network it serves.

Separately, Smith found the extender lacked strong protection around software updates. That weakness creates possible opportunities for tampered firmware installation, meaning an attacker who could interfere with the update process might be able to install altered software rather than the manufacturer's intended build.

Taken together, the issues point to a device whose security posture was not designed around an adversarial owner or a hostile network. The extender appears to have been built for cost and basic function, with protections that do not hold up once someone examines the firmware directly.

What the researcher did not conclude

Smith acknowledged that these issues do not prove manufacturers intentionally created unsafe features for malicious purposes. The hidden account and remote service could have originated from factory testing processes and remained active accidentally before consumer sales — a plausible explanation for debug or maintenance access that was never removed from production firmware.

That distinction matters for how the finding should be read. The presence of a hidden account does not by itself establish intent, and the source material does not attribute deliberate wrongdoing to the manufacturer. What it does establish is that the access existed, was reachable, and was not something a buyer could control through normal settings.

The economics of very cheap hardware

• The extender cost £3 on Temu.
• It carried six antennas.
• The processor was a MediaTek MT7620.
• Every unit using that firmware shared the same hidden administrator password.

Those numbers frame the central tension. A device sold at that price point has to cut costs somewhere, and software security is one of the places where cuts are least visible to a buyer. The purchaser sees antennas, a plastic shell, and a low price. They do not see the compile-time constants, the remote login service, or the update protections that were or were not implemented.

Consumers may focus on immediate savings while having little visibility into the software decisions built inside connected equipment. That gap between what is marketed and what is actually running on the device is where this story sits.

Not a verdict on all budget devices

The findings do not mean every inexpensive networking device contains similar weaknesses. Smith's examination covered one specific extender purchased through one specific channel. Generalizing from a single teardown to an entire product category would go beyond what the evidence supports.

What the case does show is why basic security checks matter — and why they are difficult for ordinary buyers to perform. Extracting firmware and inspecting it for hidden accounts is not a step most people can take before deciding whether to plug a device into their home network.

As more homes add connected products, hidden software features could become a larger concern for users and manufacturers. The extender in question is a small, inexpensive example, but the underlying pattern — access that exists outside the user's view and outside the user's control — is the part that travels.

What this means for buyers and networks

For anyone who has already plugged a very cheap extender or router into their home network, the practical question is not whether the device was a bargain but what it can do that the owner did not authorize. In this case, the answer reportedly includes a hidden administrator account with full control, reachable remotely, using credentials that cannot be changed through the device's own settings.

That combination suggests a device that should be treated as untrusted rather than as a simple signal booster. Placing it on a separate network segment, or removing it from a network that carries sensitive traffic, is the kind of precaution that follows from what the researcher found — although the source does not prescribe specific remediation steps.

For manufacturers, the finding is a reminder that factory testing access is not harmless if it ships to customers. A debug account that is never removed, or a remote service that accepts fixed credentials, becomes a permanent feature of every unit sold. The reputational and legal exposure of that choice is not limited to the buyer who paid £3.

For the broader market, the episode cuts against the assumption that inexpensive connected hardware is a straightforward trade of features for price. The trade may also include security decisions that the buyer never sees and the seller never mentions. Whether that becomes a larger purchasing consideration depends on how many similar findings follow — and on whether buyers have any realistic way to check before the device is already on the network.