Compliance index
Which routers still ship a universal default password
Universal default passwords on consumer connectable products are prohibited under the UK PSTI Act (in force April 2024) and targeted by the EU Cyber Resilience Act / RED. This is a live index of which models in our directory still ship one.
Updated 2026-07-25 · 236 models · every value cited to the manufacturer
How the 236 models log in
Models that still ship a universal default (64)
The genuinely risky category: a single password shared across every unit, documented by the maker. Not a legal verdict — some units predate PSTI or fall outside its scope — but this is the pattern the regulations target.
By brand
| Brand | Models | Still universal-default |
|---|---|---|
| Netgear | 21 | 10 |
| Linksys | 9 | 8 |
| Ubiquiti | 12 | 5 |
| DrayTek | 5 | 5 |
| Netgate | 5 | 5 |
| D-Link | 6 | 4 |
| Belkin | 4 | 4 |
| Peplink | 4 | 4 |
| TP-Link | 25 | 2 |
| Buffalo | 2 | 2 |
| ASUS | 19 | 1 |
| ARRIS | 3 | 1 |
| Motorola | 2 | 1 |
| NETGEAR | 2 | 1 |
| Telstra | 2 | 1 |
| Comfast | 2 | 1 |
| Actiontec | 1 | 1 |
| Airtel | 1 | 1 |
| Etisalat by e& | 1 | 1 |
| BSNL | 1 | 1 |
| EnGenius | 1 | 1 |
| Wavlink | 1 | 1 |
| Totolink | 1 | 1 |
| Rogers | 1 | 1 |
| Ruckus | 1 | 1 |
| AVM | 10 | 0 — clean |
| MikroTik | 8 | 0 — clean |
| Tenda | 7 | 0 — clean |
| Zyxel | 5 | 0 — clean |
| Keenetic | 5 | 0 — clean |
| eero | 4 | 0 — clean |
| Synology | 4 | 0 — clean |
| GL.iNet | 4 | 0 — clean |
| AT&T | 3 | 0 — clean |
| Virgin Media | 3 | 0 — clean |
| Mercusys | 3 | 0 — clean |
| Xiaomi | 2 | 0 — clean |
| Huawei | 2 | 0 — clean |
| 2 | 0 — clean | |
| Xfinity (Comcast) | 2 | 0 — clean |
| Verizon | 2 | 0 — clean |
| Plusnet | 2 | 0 — clean |
| Vodafone | 2 | 0 — clean |
| Aruba (HPE) | 2 | 0 — clean |
| Turris | 2 | 0 — clean |
| Firewalla | 2 | 0 — clean |
| Devolo | 2 | 0 — clean |
| Amazon | 1 | 0 — clean |
| Cox | 1 | 0 — clean |
| Spectrum (Charter) | 1 | 0 — clean |
| CenturyLink | 1 | 0 — clean |
| Brightspeed | 1 | 0 — clean |
| Frontier | 1 | 0 — clean |
| Optimum (Altice) | 1 | 0 — clean |
| BT | 1 | 0 — clean |
| Sky | 1 | 0 — clean |
| EE | 1 | 0 — clean |
| TalkTalk | 1 | 0 — clean |
| Deutsche Telekom | 1 | 0 — clean |
| Orange | 1 | 0 — clean |
| Vilo | 1 | 0 — clean |
| Meshforce | 1 | 0 — clean |
| Jio | 1 | 0 — clean |
| Nokia | 1 | 0 — clean |
| Cisco Meraki | 1 | 0 — clean |
| Cudy | 1 | 0 — clean |
| Netis | 1 | 0 — clean |
| Reyee (Ruijie) | 1 | 0 — clean |
| Optus | 1 | 0 — clean |
| Bell | 1 | 0 — clean |
| T-Mobile | 1 | 0 — clean |
| o2 | 1 | 0 — clean |
| TELUS | 1 | 0 — clean |
Method & data
Computed live from our router directory. Every credential type is verified against the manufacturer's own documentation — no aggregator data, no guesses. The index refreshes as the directory grows.
Free to use with attribution to ssid.ai. For a redistribution or commercial-feed license, see the API.