AP Networking 2.5: SOHO Network Security Risks and Controls

A small office or home network has six classic weak points: default router credentials, weak Wi-Fi encryption, outdated firmware, an exposed admin page, a flat network where guests mingle with trusted devices, and unmonitored connected devices. Each has a specific impact, each is closed by one specific control, and matching them is the skill the exam tests.

This is Topic 2.5 of AP Networking Unit 2. Over four topics your lab network started working, got documented, got upgraded, and gained a media server: it is now worth attacking. Topic 1.3 taught you to name a threat and match a control on one device; here that habit scales to the whole network. Topic 2.6 implements the heavier defenses. Today is identification.

• Why would anyone attack a small network?
• The six SOHO vulnerabilities and their impacts
• Each vulnerability up close
• Matching each vulnerability to its control
• Step-by-step: a 10-minute router security checkup
• Worked example: the audit that found admin / admin
• Practice: Risk Radar
• Using AI to draft a security audit, safely
• Key terms
• Frequently asked questions

Why would anyone attack a small network?

Because nobody has to choose it. Attackers run automated scans across whole address ranges, looking for routers that answer with a login page, models with unpatched flaws, and networks using broken encryption. A school lab or home network gets found by a script, not picked by a person, and the payoff does not have to be your data: a compromised router is useful for DNS redirection, free bandwidth, or as a launch point against others. The habit to build: assume the network will be scanned, and close the doors the scan checks first.

The six SOHO vulnerabilities and their impacts

Six weaknesses account for almost every SOHO compromise. Learn each impact well enough to tell them apart; exam distractors are simply the other rows' impacts.

Vulnerability	Impact if ignored
Default or weak admin credentials	An attacker signs in and reconfigures the network: DNS, ports, or a lockout.
Open or weakly encrypted Wi-Fi (WEP, original WPA)	Outsiders intercept traffic, freeload, and use the wireless as an entry point to every device.
Outdated router or AP firmware	Published exploits for known flaws keep working; attackers scan for unpatched models.
Admin page exposed to the internet or guest devices	Remote takeover: anyone reaching the login page can attack it from anywhere.
Flat network (guests and IoT share the LAN)	One compromised gadget can reach everything, including servers and trusted computers.
Unmonitored connected devices	An intruder's device keeps its access for months; nobody compares the client table to documentation.

Each vulnerability up close

Default admin credentials

Every router ships with a factory login, and every factory login is listed on the internet. Whoever holds the admin account can point DNS at a malicious server so a bank's name loads a fake page, open ports to inside devices, or change the password and lock out the real owner.

Open or weakly encrypted Wi-Fi

Wireless signals do not stop at the wall. An open network, or one on WEP or the original WPA, is readable from the parking lot: WEP cracks in minutes with free tools. That means interception, freeloading, and a foothold on the LAN itself.

Outdated firmware

Firmware is the router's operating system, and its updates are mostly security patches. Once a flaw is published, every unit still on the old version is attackable by anyone who reads the advisory. Old firmware is a known hole with a fix that was never applied.

An exposed admin page

By default the settings page is reachable only from inside the network. Two settings break that: remote management, which publishes the login page to the internet, and WPS, a join shortcut with a brute-forceable PIN. Both trade security for convenience; both should be off.

The flat network

On a flat network every device can talk to every other: the visitor's phone, the smart TV, the cheap smart plug, and the file server share one big room. The least defended gadget sets the security level for everything, because compromising it grants a position inside the LAN. The plug is not the prize; it is the entry point.

Unmonitored devices

In Topic 2.2 you built a documentation table keyed on each device's MAC. It is only a security tool if someone compares it against the router's client table. A network nobody watches is one where an intruder's device sits for months, never noticed.

Matching each vulnerability to its control

Each vulnerability is mitigated by exactly one control. This map is the core skill: a mismatched control feels like security and provides none.

Vulnerability	Matching control
Default or weak admin credentials	A strong, unique admin password.
Open / WEP / WPA Wi-Fi	Configure WPA2 or WPA3 with a strong passphrase.
Outdated firmware	Scheduled firmware updates, or auto-update.
Exposed admin page / WPS	Disable remote administration and WPS.
Flat network	Enable a guest network separating untrusted devices (Topic 2.6 extends this into segmentation).
Unmonitored devices	Scheduled review of the client list against documentation.

Step-by-step: a 10-minute router security checkup

Your team runs this walkthrough on the lab network; it is worth running at home too. All six checks happen in the router's admin interface, usually at 192.168.1.1.

1. Try the default login. If admin / admin still works, set a strong, unique password before checking anything else.
2. Read the wireless security mode. It should say WPA2 or WPA3; WEP, WPA, or Open is a finding to fix.
3. Check the firmware date. Old version with auto-update off? Schedule updates now.
4. Find remote management and WPS. Both live in advanced settings; both should be off unless there is an argued reason.
5. Look for a guest network. If visitors and IoT gadgets share the LAN with trusted machines, enable it and move them over.
6. Compare the client table to your documentation. Match each MAC against the 2.2 table; investigate anything unmatched.

Worked example: the audit that found admin / admin

The evidence. A team runs the checkup. Finding one: admin / admin is accepted. Finding two: the client table lists 23 devices, the documentation 19, last compared September.

Name each vulnerability and impact. The first is default credentials: anyone reaching the page can redirect DNS or lock the team out. The second is unmonitored devices: four unknown machines with months of access.

Match each control. Finding one gets a strong, unique admin password, set immediately. Finding two gets a client-list review, an OUI lookup on each unmatched MAC, and a monthly comparison so it cannot drift again.

Note what would NOT have worked. A stronger passphrase fixes neither finding; neither does a firmware update. Both are real controls for different rows. Matching, not listing good ideas, is what gets graded.

Practice: Risk Radar

Warm up with three sample questions, then work the walkthrough. Every distractor is correct for a different vulnerability, so reason from the evidence.

Three free sample questions

1. A Wi-Fi scan shows the lab network secured with WEP. What is the most direct impact of leaving it?

Show answer

Outsiders can intercept traffic and use the wireless as an entry point to every device (EK 2.5.A.2). WEP cracks in minutes; only WPA2/WPA3 count.

2. The router accepts the factory login. Which control closes this specific hole?

Show answer

A strong, unique admin password (EK 2.5.B.2). A new passphrase, updated firmware, or a guest network would each leave the default login working.

3. Visitors' phones join the same LAN as the file server. What vulnerability is this, and what fixes it?

Show answer

A flat network (EK 2.5.A.5): one compromised gadget can reach everything. Enable a guest network (EK 2.5.B.6); Topic 2.6 builds this into full segmentation.

Now the full walkthrough, shuffled every run.

Using AI to draft a security audit, safely

An AI assistant drafts a security audit fast: paste the settings summary and a tidy findings list appears in seconds. Use the draft, then verify it finding by finding. The classic AI failure is a real vulnerability paired with a mismatched control, like a stronger passphrase recommended for outdated firmware.

The verification question is always the same: does this control actually close this hole? Check that each named vulnerability exists in the real settings, and that each recommended control belongs to the same row as the vulnerability it claims to fix. AI drafts; the technician verifies. A mismatch that survives review is worse than a blank line, because it feels handled.

Key terms

Vulnerability

A weakness an attack could use: a default password, a broken encryption standard, an unpatched flaw.

Security control

A specific measure that mitigates a specific vulnerability. Controls match one-to-one.

Default credentials

The factory login a device ships with, publicly known and tried first by attackers.

WEP / WPA / WPA2 / WPA3

Wi-Fi encryption standards in age order. WEP and the original WPA are broken; WPA2 and WPA3 are acceptable.

Firmware

The software a router or access point runs. Updates patch published security flaws.

Remote administration

A setting that makes the admin page reachable from the internet. Keep it off.

WPS (Wi-Fi Protected Setup)

A push-button or PIN shortcut for joining Wi-Fi; the PIN is brute-forceable. Disable it.

Flat network

A network with no separation, where every device can reach every other device.

Guest network

A separate wireless network giving visitors and IoT devices internet access without reaching trusted devices.

Frequently asked questions

Why is a default router password dangerous?

Factory logins are published and tried automatically by scanning tools. Whoever signs in controls the router: they can redirect DNS, open ports, or lock out the owner. Change it to a strong, unique password.

Is WEP encryption still safe to use?

No. WEP cracks in minutes with free tools, and the original WPA is also broken. Treat both as open and use WPA2 or WPA3 with a strong passphrase.

Do router firmware updates really matter?

Yes. Firmware updates are mostly security patches. Once a flaw is published, every router still on the old version is attackable by anyone who reads the advisory, however strong its passwords.

Should remote administration be turned off?

Yes, unless there is a specific, argued need. It publishes the router's login page to the internet, turning a local weakness into a remote takeover risk.

What is wrong with WPS?

WPS offers a PIN-based shortcut past the passphrase, and the PIN design is weak enough to brute-force. Disabling it removes a crackable side door.

What does a guest network actually protect?

It separates untrusted devices, like visitors' phones and IoT gadgets, from trusted ones. A compromised guest device cannot reach your file server or computers, which a flat network would allow.

How do I check what devices are on my network?

Open the router's admin page and find the client table. Compare each entry against your documentation and investigate any MAC you cannot account for, starting with an OUI lookup.

Does a strong Wi-Fi password secure the whole network?

No. The passphrase closes only the wireless-entry vulnerability. Default credentials, outdated firmware, an exposed admin page, and a flat network all stay open until their own controls are applied.

AP is a trademark of the College Board, which was not involved in the production of, and does not endorse, this resource.