Temu’s £3 WiFi Extender Ships With Universal Root Password Backdoor

All units of Temu’s £3 Wi‑Fi range extender ship with the same hard‑coded root password, providing a universal backdoor that anyone with physical or firmware‑level access can exploit, exposing home networks to potential compromise and giving attackers a foothold for broader lateral movement.

What exactly did researchers find in the firmware?

Using a Bus Pirate, a hobbyist extracted the firmware from a Temu‑branded extender and located a nine‑character password hard‑coded into the bootloader. The password is identical across every device shipped, meaning the backdoor is not a per‑unit secret but a global credential.

How was the backdoor confirmed?

The researcher logged into the device’s admin console with the discovered password and gained root‑level shell access. From there, they could modify network settings, install arbitrary binaries, and even disable security features, all without the user’s knowledge.

Who is at risk from this vulnerability?

Anyone who purchases the £3 extender on Temu or similar low‑cost marketplaces is potentially exposed. Because the device sits between the router and client devices, a compromised extender can sniff traffic, inject malicious payloads, or pivot to other devices on the LAN.

Is the risk limited to physical attackers?

Physical access is the easiest path, but a determined remote attacker could also exploit the backdoor if they first obtain firmware access through an insecure update mechanism or a supply‑chain compromise. The universal password lowers the barrier for both scenarios.

Why do cheap IoT devices often contain such flaws?

Low‑cost manufacturers prioritize price over security, often reusing firmware across batches without unique credentials. The lack of secure boot, code signing, and proper authentication is common in budget hardware that bypasses rigorous testing.

What does this mean for the broader IoT supply chain?

It highlights how a single insecure component can become an attack vector for entire households. When a vulnerable device is introduced, it can undermine the security posture of otherwise well‑protected networks.

How can users protect themselves now?

First, avoid installing untrusted low‑cost extenders. If you already own one, change the default password immediately—though the hard‑coded root may still be reachable via other interfaces. Consider isolating the extender on a separate VLAN or guest network to limit lateral movement.

Can firmware updates fix the issue?

Only if the vendor releases a signed update that removes the hard‑coded credential and enforces unique passwords per unit. As of the latest discussion, no such update has been announced.

What steps should security teams take?

Conduct an inventory of all low‑cost Wi‑Fi extenders on corporate or home networks. Use network scanning tools to identify devices exposing unusual ports or default credentials. Apply network segmentation and monitor for anomalous traffic from these devices.

How does GetKhojo help with this problem?

GetKhojo’s attack‑surface monitoring can automatically discover rogue IoT devices, flag default credentials, and suggest remediation. Our privacy‑hygiene checklist also guides users on isolating high‑risk hardware and maintaining secure firmware practices.

What this means for you

Cheap Wi‑Fi extenders may seem harmless, but a universal backdoor turns them into easy entry points for attackers. Evaluate the necessity of such devices, enforce strong, unique passwords, and segment them from critical assets. Leveraging GetKhojo’s scanning suite can give you visibility before a breach occurs.

Frequently asked questions

Can I still use a cheap Wi‑Fi extender safely?

Only if you replace the default credentials, isolate it on a separate network, and regularly monitor its traffic. Even then, the hard‑coded root may still be exploitable, so using a reputable, security‑focused extender is recommended.

How do I check if my extender has a hard‑coded password?

Run a port scan for SSH or telnet, attempt login with common defaults, and consult the device’s firmware if possible. GetKhojo’s IoT discovery tool can automate this detection.

Will a firmware update remove the backdoor?

A firmware update can remove the backdoor only if the vendor provides a signed patch that eliminates the hard‑coded credential. Until such an update is released, the vulnerability remains.

What network configuration reduces risk from compromised IoT devices?

Place IoT devices on a dedicated VLAN or guest network, enforce strict firewall rules, and limit inter‑device communication. This containment prevents a compromised extender from reaching sensitive systems.

Is GetKhojo able to detect hard‑coded credentials automatically?

Yes, GetKhojo’s scanning engine can identify devices exposing default or known hard‑coded credentials and alert you to take immediate remediation actions.