Man cracks open £3 WiFi extender from Temu and is shocked by what he finds

A penetration tester bought an ultra-cheap device from Temu to see what, if anything, was hiding beneath its bargain-basement price and found something concerning that remains invisible to the average buyer.

Chinese-owned online store Temu has exploded in popularity thanks to its ultra low prices.

And while buying a cheap WiFi extender from the site might seem like an inexpensive way to banish connectivity dead zones, Keiran Smith’s findings were a little way off receiving a pair of shoes three sizes too small or some pants made of flimsy material.

Even more concerning is that the real cost of buying a bargain-basement device is hidden from most customers.

The £3 gadget that gets inside your home network

Smith, known online as as Affix, bought a six antenna “WiFi signal/booster / range extender” after it appeared online in an algorithmically targeted Temu ad.

At just £3, the OSCE3-certified penetration tester knew he was buying a white-label design. Whatever security protections – or weaknesses – the original manufacturer built in would also affect every reseller and their customers.

Given that WiFi extenders occupy a sensitive place in people’s homes, where they may have other personal gadgets and household devices connected to the same network, Smith decided to crack one open and see what he could find.

Smith’s investigation began with the hardware. He identified the extender’s main processor as a MediaTek MT7620, a low-cost chip widely used in routers and repeaters.

He then used a Bus Pirate to copy the contents of its SPI flash memory, where the device’s firmware is stored.

What Smith found higher up in the software presented the bigger concern.

A password the owner doesn’t know exists

Smith found that the extender contains a hidden administrator account with the highest possible privilege.

Its password is hardcoded into the firmware, meaning every device running it uses the same one.

Crucially, the hidden account is separate from the administrator password that users can change through the extender’s normal settings.

So even if an owner follows standard security advice and changes their password, the hidden password remains unchanged.

“It’s worth being precise about what makes this as bad as it is, because ‘hardcoded password’ covers a wide range of sins,” Smith wrote in his substack.

“This one is a compile-time constant rather than something derived from the MAC address or serial number, so it is identical on every unit ever sold,” he said.

Smith also found another surprise running on the device: a remote login service that will accept logins using the hidden root password.

Hidden backdoor

According to Smith, what makes it worse is that these three issues are stacked together:

• A secret admin account – a hidden login that isn't shown to the user and isn't meant to be found or changed.
• The same password on every device.
• Remote access turned on by default – meaning someone doesn't even need physical access to the device or the local network

The pentester argues these factors combine into something dangerous: a built-in, always-on backdoor that's remotely reachable and impossible for the average user to know about or turn off.

“A default credential is something the owner can see, is told about and can change,” he says. “What we have here is the opposite on every count.”

Even if the owner discovered the hidden account, and had the technical know-how to change the password manually, the extender would undo the change once it is rebooted.

Command injection

Smith also found other problems. One is a "command injection" flaw – a way for an attacker to trick the extender into running their own commands, with full control-level access to the device.

Additionally, firmware updates weren't properly locked down with strong encryption/verification, so someone could potentially tamper with an update and sneak in malicious code without the device being able to tell it wasn't legitimate.

None of it took a clever bug. The hardware dump was the easy part. The rest is a lesson in what ‘range extender’, ‘£3’ and ‘free shipping’ really costs,

– Keiran Smith / Affix, independent pentester, Substack.

Smith’s research doesn’t establish whether such access was deliberately placed in cheap devices for malicious purposes.

Smith suggests a possibility is that it was originally intended for factory testing or technical support and was simply never removed before the product reached consumers.

The white-label problem

The pentester wants to make consumers aware that a company that sells a cheap connected gadgets like Temu, may not be the same company that actually designed its hardware or software.

White-label products are manufactured by one company and then sold by other businesses, sometimes under multiple apparently unrelated brand names.

Vulnerabilities in the original design manufacturer’s (ODMs) technology can potentially end up in many different products without buyers realizing they share the same underlying technologies.

White-label hardware means whatever the ODM shipped is what every reseller's customers inherit,

- Keiran Smith / Affix, independent pentester

Earlier this year, a French researcher uncovered five critical vulnerabilities in Amazon-bought Meari-powered baby monitors and cameras, potentially affecting 1.1 million families.

More than 300 brands used the underlying platform, meaning consumers buying apparently different products could actually be relying on the same technology stack underneath.

In August, researchers found a hidden backdoor in more than 20 Zbtlink and Wiflyer router models with at least 100,000 affected routers estimated to be deployed worldwide.