Expert finds this £3 Temu Wi-Fi extender is full of security issues, and definitely not the bargain you'd hoped for

A £3 Wi-Fi extender purchased through online marketplace Temu has been found to contain significant security vulnerabilities, casting doubt on the notion of inexpensive connected devices being simple bargains. Security researcher Keiran Smith discovered hidden administrator access features within the device that regular users could not detect during normal use.

The extender, which utilized a MediaTek MT7620 processor, contained a single hidden administrator account with a fixed password embedded within its firmware. This means every unit sharing that firmware had identical credentials, and changing the normal administrator password would not disable the secret account. Furthermore, a remote login service accepted these concealed credentials without necessitating physical access to the extender itself.

Smith emphasized that this case was particularly concerning because the password was identical across devices, rather than being individually generated. The combination of hidden access, unchanged credentials, and remote availability raised serious security concerns for ordinary users. Even technically skilled individuals found that changes made to the account could be lost after restarting the device.

Additionally, the research uncovered a command injection weakness that could allow attackers to execute unauthorized instructions through the device. While Smith acknowledged that these issues did not necessarily indicate malicious intent from manufacturers, they could have originated from factory testing processes and remained active accidentally before reaching consumers.

The case of the £3 Wi-Fi extender serves as a reminder that extremely cheap smart devices can present security challenges that extend beyond their purchase price. Consumers may prioritize immediate savings while having limited visibility into the software decisions embedded within connected equipment.