Port 80, 443, and the Open Gate: How ISP Routers Leak Their Management Plane to the Public Internet

A few months back developer associated with veronami, Amaya was using a IP scanner to know the sip server address for an internet service she had subscribed with Bharti Airtel. While scanning she came to know that some ip addresses reportedly had port 80 or 443 or both open, curious by nature she visited those ips and to her shock it 3 out of 5 times it was the wifi management page of the router.

Prior airtel used to have default superuser passwords that granted complete access to web gui and sometimes we can actually configure the webpage to open port 22 for ssh, before they switched to routers by zyxel which have been using serial number as user password with hope that superuser password has been serialized too.

Amaya was able to login to all older hardware presenting a major security laspe if you are a business. Most people would ask if it is that serious of security lapse? Well yes if anyone has access to router and can ssh into it, chances are they can install a vpn too and infiltrate your network. All of a sudden they will have access to all iot devices, nas, printers, servers, etc. Do you really want to risk them getting closer to this data and services? Hopefully not.

So what can you really do about it?

1. If you are a consumer ask and your web UI is accessible on internet after typing its ip followed by :<port> 80 or 443 or 8080, for example if your IP is 1.1.1.1 try running 1.1.1.1:80 or 1.1.1.1:443 or 1.1.1.1:8080 on browser, please reach out to ISP immediately and let them know about this breach and ask them to fix it or replace it.
2. If you are a business, why are you on ISP hardware? You should be on a custom router like bpi-r3 with sfp stick for more robust configuration of firewall and subnets.

We can assist you with too,

Schedule a consultation here.

A developer discovered Bharti Airtel routers frequently expose ports 80 and 443, allowing public internet access to web management pages. Attackers exploiting default credentials can enable SSH, deploy VPNs, and compromise internal networks. Users should test their IP for exposed ports and contact Airtel, while businesses should replace ISP hardware with dedicated, custom routers.