ARRIS SURFboard W6B has unauthenticated root backdoor

A researcher on the OpenWrt forum says ARRIS SURFboard W6B units contain an unauthenticated root backdoor that grants Telnet console access over Ethernet. The same path can reconfigure the locked bridge-mode devices to behave like standalone W6U-style access points without opening the case or soldering.

Posting as Gamma662keV, the researcher said the access looked intentionally installed, came up while converting cheap W6B pairs for use as ordinary APs, and has already been reported to the vendor. A few weeks are being allowed for a response before code is published. Owners who want the current behavior for conversion were advised to block the units from reaching their update server; the backdoor is also described as fixable locally, so a later vendor patch need not strand devices.

Unauthenticated root on consumer networking gear matters beyond hobbyist repurposing: anyone who can reach the device on the local network can take full control, not only buyers frustrated by the W6B’s tight bridge lock-in.