Bug "Router has a weak password" always... no matter what...

[REDACTED]

I recently set up a new router. I changed every password and username I could to be as secure as possible. Avast Mobile Security scans and says the router has a weak password. I read the "More info" page. I change the administrative password and re-scan. Several times. I am using every secure password rule I've ever heard.  I am using long brand new, randomized gibberish passwords with upper case, lower case, numbers, and special characters, and every time I re-scan it still says I have a weak password. I updated the app, and re-scanned. It still says I have a weak password.

While I was registering for this forum I even tried typing in the passwords I had tried using and the password checker for this forum even confirmed that every single one of the passwords I had tried were very strong, except for one that was only strong.

So at this point, it seems like the Wi-Fi Check is simply broken and does not work...

[Eddy]

It doesn't have to be broken.
Routers often have a "backdoor" especially when they run on a OS. (e.g. WebOS)

avast is not only checking from the inside, but also approaches the router/system from the outside.

[REDACTED]

OK.  Well avast isn't telling me that there's a back door.  It's telling me that the administrative password is weak.

[REDACTED]

and if it is a back door, being reported incorrectly, how would I fix it?

[REDACTED]

Anyone have any helpful input?  Do I need to get a different brand of router? Do I need to just stop using avast?

[Eddy]

Install the latest firmware on the router and see if it makes a difference.

[REDACTED]

It made me install the latest firmware as soon as I set it up. I double checked. It's current.

[Ondra Cermak]

Hi,

could you please share what brand and model of router do you have? I'll forward it to the team that takes care of network security.

Thanks

Ondra

[REDACTED]

Yeah.  It's a NETGEAR model R6400.

By the way I did run avast's wi-fi check on someone else's wi-fi and it came back as secure.

A friend of mine suggested that, with my router, it could be detecting a vulnerability with the WPS.  Apparently NETGEAR doesn't let you turn off WPS completely, but I did disable the router's pin (the closest they let you come to turning off WPS) and avast is still saying that it has a weak administrative password.

[REDACTED]

I appear to have the same or a similar problem as the original poster. I have a NetGear N6400 router that I have had for a while now (a year or more). I have had Avast installed on a Windows7 PC and on an Android phone before I got this particular router and all scans used to show everything was fine on my network with my old router and the current one. I upgraded the router firmware sometime last month from version 1.0.1.6_1.0.4 to 1.0.1.12_1.0.11 and both my phone and Windows7 PC now claim the router admin password is weak.

I ran some tests and I think I found the problem. The new firmware version allows the user to configure password recovery. It asks you a couple of personal questions on the setup page when you check the box to enable it. I don't believe my old firmware version had this option but I could be wrong. If password recovery is not enabled and you enter an invalid username and password then you get prompted to enter them again every time you do not enter the correct values. However, once password recovery is enabled then if you enter the incorrect username/password, it prompts you to enter them a second time. If you fail a second time then it displays a Router Password Recovery page that asks me for the router serial number. I assume if I enter the serial number the page will also ask me to enter the two security questions and allow me to reset the password.

My scans from my phone and PC no longer fail once I disabled the password recovery option.

It's not clear to me if Avast considers this password recovery feature to be insecure or if this is a bug in Avast.

[REDACTED]

I suddenly found I was getting the same weak password alert. I've been busy making changes to my network  last few weeks so *had* had the default admin password on the router, but even then I hadn't had this warning previously on this machine the last full scan I'd done on it. Only got the warning today so reset the routers admin interface password, made no difference, rebooted router & machine numerous times & it was still flagging it even though I'd definitely changed the password.

It's maybe just coincidence & was some later 'refreshing' of the data avast was accessing (I'd already tried deleting the scan logs, btw, to no success) but I finally got it passing after I'd looked into all my router settings & found there was a page with password access if you used USB mass storage attached to the router. It, regardless of me changing the main admin log-in still showed the old default one as 'master' but once I changed it, then rebooted the router, it passed the Avast scan.

My particular router is a TP-Link one, but thought it worth sharing the info just in case it's a solution for anyone else as during my research earlier had noticed users with differing makes having the same problem. Drill down every bit of the router settings & see if there's another ref to a default/master password.

[REDACTED]

It's maybe just coincidence & was some later 'refreshing' of the data avast was accessing (I'd already tried deleting the scan logs, btw, to no success) but I finally got it passing after I'd looked into all my router settings & found there was a page with password access if you used USB mass storage attached to the router. It, regardless of me changing the main admin log-in still showed the old default one as 'master' but once I changed it, then rebooted the router, it passed the Avast scan.

My particular router is a TP-Link one, but thought it worth sharing the info just in case it's a solution for anyone else as during my research earlier had noticed users with differing makes having the same problem.

Thanks for posting that info Moviecat - very useful. I'd been trying to sort out the same problem on my TP-Link router for several weeks. All is now well!

[=Snake=]

@Ondra Cermak
Hi!

I just saw this theme and since I changed my home, I had to change internet-provider and router, too.
Since then I still have the same problem: weak pw!
My router is a: o2 Homebox 6441.
In the meantime I learned to ignore the avast warnings for I used several special letters (not only '!' or '?'). Even if you use (implement) more the 2 of them, avast will answer with that warning.
I'm waiting for a fix since Dec.

=Snake=

[dd673]

Just wanted to confirm the assertion above. Turning off "Enable Password Reset" for the router was enough for Avast to pass my setup with "No vulnerabilities found!".

Modem/Router: Netgear C7000v2
Firmware: V1.03.03