KT Olleh Wi-Fi Modem (KM04-112H) - Security concerns

This is an information provided as a way to show people why they need to change their passwords.
Please do not use this information for nefarious purposes.

So, this is a router from Korea Telecom (KT Olleh), a big telco from South Korea.
This router is quite old, from 2013. I happened to get 8 of those from the dumpster.
This is an auto-setting router, which automatically sets its settings up when it first boots up or when "Wireless Auto Setup" button is pressed.
It has about 64 megabytes of DDR2 SDRAM and onboard storage of approximately 128MB.
It uses RTL8198T SoC.
It is manufactured by Mercury, a Chinese company specializing in making telco stuff.

Here's the circuit board:

  So, since this is almost a "fool-proof" router which just works when it's plugged in, you might assume it at least has some sort of security features so wannabe hackers can't easily peep into the private life of people who are using this, right?

The answer is, no.

First of all...
This thing has telco backdoors.

Look at this translation of the sticker on the backside of this unit.

 
Yes. It literally says "[...] This device may be remotely controlled [...]"
(Read: Hack me please, I don't give a fuck about customer's security and privacy and I can't be bothered to put in some kind of verification steps)

Second, the default passwords and AP SSID is comparable to the practice lock being on a bank safe.

Let me explain it to you.

So here's the pretend MAC address of the router:
00:AF:DE:D5:EC:0D

And you want to guess the password.
Here's what you do:
1. Put six zeroes in first.
PW: 000000
2. Type in last 4 letters from the MAC address right after that.
PW: 000000EC0D
3. Blammo, you just h4x0r'd the router.
>_


AP SSID is generated like this:
KT_WLAN_XXXX
X is 4 letters from the MAC address again, but this time the filter is different:
XX:XX:XX:12:X3:4X
Number 1 through 4 is where the name generator looks for characters to use.
Thus, using the MAC address from above, the SSID is:
KT_WLAN_D5C0

So basically these guys did what TP-LINK did with their routers, opening them to hackers.
MAC address can be found in like 10 seconds after receiving a single packet from the router.
Don't use it to generate passwords!!!!