Arris / Arris-variant DSL/Fiber router critical vulnerability exposure
&gt;<i>It is possible to recover the WiFi access code and SSID, remote administration password, SIP credentials (if VoIP is supported), ISP CWMP&#x2F;TR-069 endpoint URLs and their username and password as well as other sensitive information, although some parts may require more complicated techniques or computing resources that may not be available to all attackers. Network-based unauthenticated exploitation is most severe if the router’s web services (such as the administration portal) are exposed to the Internet, though it can also be exploited on the LAN.</i><p>I just a few weeks ago got another Arris S33 modem for a client using cable, it&#x27;s fairly well regarded. While this vulnerability doesn&#x27;t list those, to me this further highlights how it can be valuable to separate out networking components vs all-in-one. The modem is purely a modem and talks only to the ISP. The router is a SuperMicro system running OPNsense, which then goes out to TP-Link Omada (or UniFi at another older site) gear for switching and WiFi. There is a network control VLAN as well as admin VLAN accessible only via WireGuard, which is the only way to get to the modem&#x27;s admin page from the LAN. Controllers are self-hosted with network control VLANs at multiple sites again routed via WG to the controller.<p>While there are other advantages as well in terms of being able to replace parts piecemeal for less, better coverage etc, it&#x27;s also nice in terms of vulns in one thing doesn&#x27;t necessarily mean everything else instantly collapses, and it&#x27;s easier to have multiple layers. The router is still a chokepoint, but full opensource and standard hardware at least mean a lot of extra eyes and tools can be applied to it and one is never at some vendor&#x27;s mercy for firmware updates. Modem compromise wouldn&#x27;t affect the LAN beyond potentially messing with WAN access which would be noticeable fairly quickly. Default LAN users can&#x27;t easily touch any of the infrastructure either. All while being transparently usable with internet of shit stuff that people want to utilize. Full zero-trust or a virtual overlay network might be better yet but starts to run into the same legacy issues that hound so much of the industry particularly for non-tech SoHo&#x2F;SMB. While it&#x27;s unfortunate how riddled with issues a lot of ISP devices have tended to be, it&#x27;s pretty nice what reasonably priced powerful options exist for anyone with networking now across a huge range of skill levels. It could be much better still but it&#x27;s not nothing.