Expert finds this £3 Temu Wi-Fi extender is full of security issues, and definitely not the bargain you'd hoped for

The £3 Wi‑Fi extender sold on Temu has been exposed as a security nightmare, with a hardcoded administrator password that gives anyone remote control. Security researcher Keiran Smith’s firmware analysis shows the flaw is baked into every unit, not just a single batch. For anyone who assumes cheap networking gear is harmless, the device proves that low price can mask high‑risk backdoors.

Hardcoded Credentials Across All Units

Smith extracted the firmware and discovered a concealed admin account that uses the same password on every device. The password is a compile‑time constant, meaning it never changes even when the visible admin password is altered. This defeats the typical “default‑change” model where owners can secure a device by updating credentials.

The processor inside the extender is a MediaTek MT7620, a chip common in budget networking products. Because the firmware is shared across many manufacturers, the vulnerability can propagate silently to other devices that reuse the same code base. The uniform credential creates a single point of failure that attackers can exploit at scale.

Smith emphasizes that a “hardcoded password” is more severe when it is identical across all units rather than being generated per device. A default password can be overwritten; a compile‑time constant cannot be removed without flashing new firmware. Consequently, any network that includes this extender is exposed to persistent, undetectable access.

Remote Access Without Physical Proximity

The extender runs a remote login service that accepts the hidden credentials over the network. This service does not require the attacker to be on the same LAN; it can be reached from the internet if the network is improperly firewalled. The presence of such a service turns a simple range‑extender into a potential foothold for external actors.

Because the secret account has full control, an attacker could reconfigure DNS, inject traffic, or create additional user accounts. The firmware does not expose any logs or alerts for this hidden access, so the victim remains unaware. The risk escalates when the extender is placed in a home or small business where users lack sophisticated monitoring tools.

Smith’s findings illustrate a broader trend: cheap IoT devices often ship with backdoors that bypass ordinary security settings. When the backdoor is coupled with remote access, the device becomes a low‑cost entry point for larger network compromises. This undermines the assumption that only high‑value targets are worth protecting.

Implications for Low‑Cost IoT Procurement

The Temu extender case forces buyers to reconsider the trade‑off between price and security. While the device advertises six antennas and “plug‑and‑play” convenience, the hidden admin account nullifies those benefits. Organizations that prioritize budget over vetting may inadvertently introduce systemic vulnerabilities.

Keiran Smith, a certified penetration tester, discovered the issue after a targeted ad led him to purchase the product. His methodology—hardware inspection, firmware extraction, and credential analysis—highlights the depth of scrutiny cheap devices often escape. Consumers lacking such expertise are unlikely to detect these flaws before deployment.

Regulators and platform operators face pressure to enforce stricter security standards for low‑cost network hardware. Without mandatory firmware audits or disclosure requirements, manufacturers can continue to ship devices with embedded backdoors. The market therefore rewards price over privacy, a dynamic that endangers everyday users.

What This Actually Means For You

1. Do not trust low‑price networking gear without independent security verification.
2. Assume any device that lacks transparent firmware updates may contain hidden accounts.
3. Isolate inexpensive IoT devices on a separate VLAN or guest network to contain potential breaches.
4. Regularly audit network traffic for unexpected remote login attempts, especially from unknown IP ranges.
5. Prefer vendors that publish security bulletins and provide signed firmware images.

Immediate Action Steps

If you already own the Temu extender, disconnect it from your network immediately and replace it with a reputable model that offers signed updates. Check your router’s DHCP lease table and logs for any unknown MAC addresses that may correspond to the extender’s hidden service.

For new purchases, verify that the device’s firmware can be inspected or that the manufacturer provides a clear process for changing all default credentials. When possible, select products that have undergone third‑party security assessments and that disclose their cryptographic practices.

Frequently Asked Questions

What is the security risk of the £3 Temu Wi‑Fi extender?

The extender contains a hidden administrator account with a fixed password embedded in the firmware, giving anyone remote full control. This backdoor works even if the visible admin password is changed, and it can be accessed over the network without physical contact.

Can the hidden password be disabled by changing the normal admin password?

No. Changing the visible administrator password through the device settings does not affect the concealed account, because the secret credentials are hardcoded at compile time and remain unchanged across all units.

How does the remote login service affect network safety?

The service accepts the concealed credentials remotely, allowing attackers to connect from outside the local network if the router permits it. This creates a persistent entry point that bypasses typical firewall rules and can be used to manipulate network traffic.

What Do You Think?

Given the ease with which a £3 device can undermine an entire network, should consumers abandon ultra‑cheap IoT hardware in favor of verified security, even at higher cost?