{"source":"https://ssid.ai/reports/router-default-credentials-2026","license":"Free to use with attribution to ssid.ai. Commercial redistribution: see https://ssid.ai/api-docs","title":"The router default-password problem, measured: what 277 manufacturer-verified models actually show","dateDrafted":"2026-07-31","dataAsOf":"2026-07-30","totalModels":277,"byCredType":[{"credType":"static","label":"Ships a universal default","count":81,"share":29,"meaning":"The PSTI-banned pattern — same password on every unit off the line"},{"credType":"set-on-setup","label":"Forces you to set a password on first setup","count":90,"share":32,"meaning":"No default exists; you can't finish setup without choosing one"},{"credType":"label-unique","label":"Unique password printed on the device label","count":71,"share":26,"meaning":"Per-unit unique, compliant, but the label is now the attack surface if it's photographed or the box is discarded carelessly"},{"credType":"app-only","label":"App-only, no web login","count":35,"share":13,"meaning":"No credential to leak in the traditional sense — the device only configures through a vendor's mobile app and account"}],"byCategory":[{"category":"Router","count":146,"share":53,"staticCount":50,"staticShare":34},{"category":"Gateway","count":78,"share":28,"staticCount":22,"staticShare":28,"note":"Modem/router combo, mostly ISP-provided"},{"category":"Mesh system","count":42,"share":15,"staticCount":1,"staticShare":2},{"category":"Access point","count":11,"share":4,"staticCount":8,"staticShare":73,"note":"Small sample — treat cautiously"}],"byBrand":[{"brand":"Peplink","total":9,"staticCount":9,"share":100},{"brand":"DrayTek","total":6,"staticCount":6,"share":100},{"brand":"Netgate (pfsense)","total":5,"staticCount":5,"share":100},{"brand":"Belkin","total":4,"staticCount":4,"share":100},{"brand":"Linksys","total":10,"staticCount":9,"share":90},{"brand":"D-Link","total":6,"staticCount":4,"share":67},{"brand":"SaskTel","total":4,"staticCount":2,"share":50},{"brand":"Netgear","total":26,"staticCount":12,"share":46},{"brand":"Zyxel","total":9,"staticCount":4,"share":44},{"brand":"Ubiquiti","total":12,"staticCount":5,"share":42},{"brand":"TP-Link","total":28,"staticCount":3,"share":11},{"brand":"ASUS","total":20,"staticCount":1,"share":5},{"brand":"AVM (FRITZ!Box)","total":10,"staticCount":0,"share":0},{"brand":"MikroTik","total":8,"staticCount":0,"share":0},{"brand":"Tenda","total":7,"staticCount":0,"share":0},{"brand":"Synology","total":4,"staticCount":0,"share":0},{"brand":"GL.iNet","total":4,"staticCount":0,"share":0},{"brand":"Keenetic","total":5,"staticCount":0,"share":0},{"brand":"eero","total":4,"staticCount":0,"share":0}],"methodology":{"totalModels":277,"highConfidence":187,"highConfidencePct":68,"mediumConfidence":90,"mediumConfidencePct":32,"sourceCitationRows":7758,"distinctSourceUrls":195,"coverageHistory":[{"date":"2026-07-11","models":29},{"date":"2026-07-15","models":211},{"date":"2026-07-30","models":277}]},"changeHistory":{"observationWindowDays":19,"observationStart":"2026-07-11","observationEnd":"2026-07-30","compilePasses":28,"deviceVersionRows":6984,"addedRows":277,"verifiedUnchangedRows":6707,"realCredentialChangeEvents":0,"ouiHistory":{"trackingSince":"2026-07-17","totalRows":39898,"renamedEvents":29,"confirmedRealEvents":5,"noiseEvents":24,"noiseNote":"24 of 29 'renamed' events come from just two OUI prefixes (0001C8, 080030) toggling between two organization-name strings on nearly every daily IEEE fetch — almost certainly an artifact of IEEE's own published registry file, not real repeated reassignment.","confirmedEvents":[{"date":"2026-07-26","description":"Four Cisco Meraki-assigned OUI blocks (847D7E, 9C4DC2, 1C84A6, 1C2226) reassigned from \"Cisco Meraki\" to \"Cisco Systems, Inc\" in IEEE's registry — all four the same day."},{"date":"2026-07-23","description":"One OUI block (F0DB30) renamed from \"Yottabyte\" to \"Verge.io\" in IEEE's registry."}]},"archiveCoverage":{"startedDate":"2026-07-27","deviceVersionsArchived":6,"deviceVersionsTotal":6984,"ouiHistoryArchived":20,"ouiHistoryTotal":39898}},"fullStaticModelList":"https://ssid.ai/compliance/data.json"}