Compliance index
Which routers still ship a universal default password
72% of the 424router models we track no longer ship a universal default password — verified against each manufacturer's own documentation. Universal defaults on consumer connectable products are prohibited under the UK PSTI Act (in force April 2024) and targeted by the EU Cyber Resilience Act / RED.
Updated 2026-09-09 · 424 models · every value cited to the manufacturer
How the 424 models log in
Models that still ship a universal default (117)
The genuinely risky category: a single password shared across every unit, documented by the maker. Not a legal verdict — some units predate PSTI or fall outside its scope — but this is the pattern the regulations target.
By brand
| Brand | Models | Still universal-default |
|---|---|---|
| Netgear | 37 | 15 |
| Linksys | 15 | 9 |
| Peplink | 9 | 9 |
| D-Link | 13 | 8 |
| DrayTek | 7 | 7 |
| Ubiquiti | 13 | 6 |
| Zyxel | 11 | 6 |
| Netgate | 6 | 6 |
| TP-Link | 41 | 4 |
| Belkin | 4 | 4 |
| ARRIS | 6 | 3 |
| Hitron | 3 | 3 |
| Cisco | 3 | 3 |
| Huawei | 5 | 2 |
| SaskTel | 4 | 2 |
| Comfast | 3 | 2 |
| Technicolor | 3 | 2 |
| Buffalo | 2 | 2 |
| ASUS | 27 | 1 |
| MikroTik | 10 | 1 |
| Motorola | 2 | 1 |
| Telstra | 2 | 1 |
| Rogers | 2 | 1 |
| Ruckus | 2 | 1 |
| Edimax | 2 | 1 |
| SoftBank | 2 | 1 |
| Actiontec | 1 | 1 |
| Airtel | 1 | 1 |
| Etisalat by e& | 1 | 1 |
| BSNL | 1 | 1 |
| EnGenius | 1 | 1 |
| Wavlink | 1 | 1 |
| Totolink | 1 | 1 |
| NOW Broadband | 1 | 1 |
| Totalplay | 1 | 1 |
| Spark | 1 | 1 |
| Vivo (Telefônica Brasil) | 1 | 1 |
| ZTE | 1 | 1 |
| VNPT Technology | 1 | 1 |
| Prolink | 1 | 1 |
| Ubee | 1 | 1 |
| Türk Telekom | 1 | 1 |
| AVM | 13 | 0 — clean |
| Grandstream | 9 | 0 — clean |
| Tenda | 7 | 0 — clean |
| Verizon | 6 | 0 — clean |
| Keenetic | 6 | 0 — clean |
| Vodafone | 5 | 0 — clean |
| Honor | 5 | 0 — clean |
| Deutsche Telekom | 4 | 0 — clean |
| eero | 4 | 0 — clean |
| Synology | 4 | 0 — clean |
| GL.iNet | 4 | 0 — clean |
| Firewalla | 4 | 0 — clean |
| Claro Brasil | 4 | 0 — clean |
| AT&T | 3 | 0 — clean |
| Virgin Media | 3 | 0 — clean |
| Mercusys | 3 | 0 — clean |
| Devolo | 3 | 0 — clean |
| Vodafone Italy | 3 | 0 — clean |
| FPT Telecom | 3 | 0 — clean |
| Xiaomi | 2 | 0 — clean |
| 2 | 0 — clean | |
| Xfinity (Comcast) | 2 | 0 — clean |
| Plusnet | 2 | 0 — clean |
| EE | 2 | 0 — clean |
| TalkTalk | 2 | 0 — clean |
| Orange | 2 | 0 — clean |
| Aruba (HPE) | 2 | 0 — clean |
| Bell | 2 | 0 — clean |
| Turris | 2 | 0 — clean |
| Ruijie Reyee | 2 | 0 — clean |
| Kinetic by Windstream | 2 | 0 — clean |
| KDDI au Hikari | 2 | 0 — clean |
| Inseego | 2 | 0 — clean |
| Fortinet | 2 | 0 — clean |
| Amazon | 1 | 0 — clean |
| Cox | 1 | 0 — clean |
| Spectrum (Charter) | 1 | 0 — clean |
| CenturyLink | 1 | 0 — clean |
| Brightspeed | 1 | 0 — clean |
| Frontier | 1 | 0 — clean |
| Optimum (Altice) | 1 | 0 — clean |
| BT | 1 | 0 — clean |
| Sky | 1 | 0 — clean |
| Vilo | 1 | 0 — clean |
| Meshforce | 1 | 0 — clean |
| Jio | 1 | 0 — clean |
| Nokia | 1 | 0 — clean |
| Cisco Meraki | 1 | 0 — clean |
| Cudy | 1 | 0 — clean |
| Netis | 1 | 0 — clean |
| Reyee (Ruijie) | 1 | 0 — clean |
| Optus | 1 | 0 — clean |
| T-Mobile | 1 | 0 — clean |
| o2 | 1 | 0 — clean |
| TELUS | 1 | 0 — clean |
| Free | 1 | 0 — clean |
| Starlink | 1 | 0 — clean |
| Ziply Fiber | 1 | 0 — clean |
| iiNet | 1 | 0 — clean |
| TPG | 1 | 0 — clean |
| Three | 1 | 0 — clean |
| Telmex | 1 | 0 — clean |
| Vivo | 1 | 0 — clean |
| Movistar | 1 | 0 — clean |
| Eastlink | 1 | 0 — clean |
| NTT East | 1 | 0 — clean |
| HKBN | 1 | 0 — clean |
| H3C | 1 | 0 — clean |
| Etisalat | 1 | 0 — clean |
| eir | 1 | 0 — clean |
| NTT West | 1 | 0 — clean |
| So-net (Sony Network Communications) | 1 | 0 — clean |
| SK Broadband | 1 | 0 — clean |
| Comcast / Xfinity | 1 | 0 — clean |
| Google Fiber | 1 | 0 — clean |
| SFR | 1 | 0 — clean |
| Spectrum (Charter Communications) | 1 | 0 — clean |
| Kaon (Kaonmedia) | 1 | 0 — clean |
| Sagemcom | 1 | 0 — clean |
| NetComm (Aussie Broadband) | 1 | 0 — clean |
| CIG | 1 | 0 — clean |
| Ziggo | 1 | 0 — clean |
| Swisscom | 1 | 0 — clean |
| Vodacom | 1 | 0 — clean |
| Singtel | 1 | 0 — clean |
Compliance trend over time
Each verification is recorded, not overwritten — this is the only independent longitudinal record of whether router manufacturers actually moved off universal default passwords. The record starts here; it will show real movement as more years accumulate.
Method & data
Computed live from our router directory. Every credential type is verified against the manufacturer's own documentation — no aggregator data, no guesses. The index refreshes as the directory grows.
Free to use with attribution to ssid.ai. For a redistribution or commercial-feed license, see the API.
FAQ
- Which routers still use default passwords?
- 117 of the 424 router models in this index still ship a universal default password — one shared password documented across every unit, including Actiontec MI424WR (Verizon FiOS) (admin / password), Airtel Xstream Fiber Router (admin / password), ARRIS SURFboard SBG7600AC2 (admin / password), ARRIS TG862 (izzi México gateway) (admin / password). The full list of 117 models, each cited to the manufacturer's own documentation, is on this page.
- What percentage of routers ship with a universal default password?
- 28% of the 424 router models we track still ship a universal default password, so 72% no longer do — they force a password at first setup, print a password unique to each unit on the device label, or are app-only. Measured against each manufacturer's own documentation and updated as the directory grows (last updated 2026-09-09).
- Do modern routers still use admin/admin as the default password?
- No, not most of them: 72% of the 424 models in this index no longer ship a universal default password — they force a password at first setup, print a unique one on the device label, or are app-only. 117 models still ship a shared default.
- Which router brands ship with a universal default password?
- 42 brands in this index have at least one model still shipping a universal default: Netgear (15), Linksys (9), Peplink (9), D-Link (8), DrayTek (7), Ubiquiti (6), Zyxel (6), Netgate (6). See the full brand breakdown above for exact counts.
- Is a universal default router password illegal?
- In the UK, the PSTI Act (in force since April 2024) prohibits universal default passwords on consumer connectable products. The EU's Cyber Resilience Act / RED delegated act targets the same pattern on its own timeline. This index tracks which models still ship one.