The 10-Minute Router Hygiene Drill (Nation-State Grade)

This drill is ordered by return on investment — the thing that closes the biggest gap first. Ten minutes, in order. (Based on the TTPs in the July 2026 joint advisory AA26-194A.)

1. Update the firmware (2 min)//

Log into your router and check the firmware version against the vendor's latest. "It works, don't touch it" is the single most expensive phrase in home networking — the device that's been running since 2019 is the one with the known, published bugs. If your ISP gave you a router, check whether it even receives updates; many don't.

2. Kill WAN-facing admin (2 min)//

Find the "remote management" or "WAN admin" toggle and turn it off unless you truly need to reach home from a plane. If you do need it, don't leave it on port 80/443 with default creds — put it on a non-standard port behind a VPN, or at minimum an IP allowlist. This is the #1 way home routers end up with a nation-state guest.

3. Turn off WPS + UPnP (1 min)//

WPS (Wi-Fi Protected Setup) has been a known weak point for years — the PIN brute-force is trivial. Off. UPnP lets any LAN device punch a hole in your NAT with your router's permission — handy for gaming, but it's also how malware on one device exposes itself to the internet without you knowing. If you don't need it, off.

4. Isolate IoT onto a separate VLAN/SSID (2 min)//

Your smart bulbs, your ESP32s, your fridge — none of them should be on the same flat network as your laptop. Create an IoT SSID (or VLAN) with its own subnet and block initiated traffic from IoT to LAN. If a bulb gets compromised, it should only be able to talk to the internet, not to your NAS.

5. Unique admin credentials + MFA (1 min)//

Change the default admin password to something long and unique. If the router supports MFA on the admin interface, enable it. The "admin/admin" and "admin/password" combos are the reason the advisory exists.

6. Scan your own WAN IP (1 min)//

From a mobile hotspot (so you're actually coming from outside), scan your public IP and see what's listening:

nmap -Pn -sV <your-wan-ip>

Everything you see there is intentionally exposed to the internet. If you see Telnet, an admin panel, or a service you don't recognize, you've found a gap. (Do this before and after the drill — the before-scan is the fun part.)

7. Verify with a rogue-SSID check (1 min)//

Walk the house with your phone and watch the Wi-Fi list. Any SSID you don't remember — a clone of your own, or a random "FreeGua…" — is either a neighbor's (fine) or an air-gap buster someone left in the rack (not fine).

What this closes//

• Stale firmware → known bugs
• WAN admin → the front door
• WPS/UPnP → weak PINs and silent holes
• No segmentation → lateral movement
• Default creds → the whole reason