Broadband ISP Virgin Media UK restrict Hub 4 router access over security fears
Some customers of fixed broadband provider Virgin Media (O2), such as those still using the operator’s older Hub 4 (Arris TG3492LG-VMB) router, have recently begun reporting to ISPreview that they’re no longer able to access the device’s web-based admin User Interface (UI) and are instead being faced with “Unable to Connect” messages. But the change is intentional.
The ability to access and thus configure your home broadband router is a critically important feature for many people, which is normally achieved by inputting an IP address into a web browser and then using the default login and password details supplied by your ISP to reach the admin interface (always change the password for this from the default). This is typically http://192.168.100.1 (modem-only mode) or http://192.168.0.1 on the Hub 4.
Unfortunately, over the past few days we’ve seen a steadily rising number of complaints reach our inbox concerning the Hub 4 (special credit to Paul and Adrian for the earliest tips), which all state that customers with the aforementioned router can no longer access the device’s admin UI. The issue has also cropped up on social media, such as via Reddit.
Advertisement
Some of those complaining about the problem state that VMO2’s support teams have struggled to understand the issue customers are facing. The good news is that those in this boat aren’t going crazy and Virgin Media have confirmed to ISPreview that it’s a deliberate, if temporary, change to protect customers from a possible security vulnerability.
A Virgin Media spokesperson said:
“While there is no evidence that any vulnerability has been exploited within our systems, out of an abundance of caution we have temporarily disabled access to the web-based router settings on a small proportion of customers’ WiFi hubs while we apply a patch. This will not impact a customer’s WiFi connection and they can continue to use their broadband services as normal, while they can also continue to access their device’s settings through other means. We will apply the patch as soon as possible.”
At this stage it’s unclear which specific security issue Virgin Media might be trying to defend against, although we’ve seen some speculation that the router’s interface may have been using some older PHP code (i.e. the PHP2Shell exploit that recently flooded the news could be a candidate).
However, despite the above speculation, we’ve been unable to confirm whether this is actually the case. Virgin Media didn’t clarify when we asked and we weren’t aware of the Hub 4 using PHP before, but then nor do we have detailed knowledge of its internal software.
Historically major broadband ISPs often take a long time to test, trial and then gradually deploy new firmware fixes for complex issues (partly because such work often involves third-party vendors). The suspicion is that it could take anything from a few weeks or longer before access can be restored to normal.
Advertisement
In the meantime, some customers have been able to re-gain access by disconnecting the coax cable from their Hub 4 and doing a full hardware reset (pin hole press), which could be handy if you need to change something specific. But just remember that the restriction is likely to re-applied after reconnecting the coax and resetting the device.
The catch here is that, without knowing the specific risk, we think it’s probably better to leave the router in its restricted state and await a proper fix. Finally, the “other means” mentioned above by VMO2 likely refers to the fact that customers can still control most of their Hub 4’s settings via the Virgin Media Connect App on iOS and Android devices.
Mark is a professional technology writer, IT consultant and computer engineer from Dorset (England), he also founded ISPreview in 1999 and enjoys analysing the latest telecoms and broadband developments. Find me on X (Twitter), Mastodon, Facebook, BlueSky, Threads.net and Linkedin.
« Altnet broadband ISP Connect Fibre promotes Jacob Mills to UK CEO
Advertisement
Leave a Reply
Privacy Notice: Please note that news comments are anonymous, which means that we do NOT require you to enter any real personal details to post a message and display names can be almost anything you like (provided they do not contain offensive language or impersonate a real person's legal name). By clicking to submit a post you agree to storing your entries for comment content, display name, IP and email in our database, for as long as the post remains live.
Only the submitted name and comment will be displayed in public, while the rest will be kept private (we will never share this outside of ISPreview, regardless of whether the data is real or fake). This comment system uses submitted IP, email and website address data to spot abuse and spammers. All data is transferred via an encrypted (https secure) session.
In my opinion ISPs could save so much money by simply allowing people to purchase an off-the-shelf routers at time of signup, like ASUS, TP-Link, Ubiquity etc. Just give people the 3 choices between £50 and £200 and also have an option for MODEM only signup like they used to back in 2010.
They used to do this back around 2010. They simply provided a Motorola MODEM, and the customer would use their own ROUTER, VM also Provided D-Link DIR615 routers for a short period if you needed one (excellent routers for their time [supported DD-WRT]).
They way ISPs are moving nowadays trundling along trying to sell “WiFi” as opposed to “Internet”, while commissioning their own cheaply produced routers and trying to manage their own clunky firmware is extremely un-economical. In my opinion ISP branded hubs are overpriced networking products for what the customer ends up paying for them and the level of features/performance you get.
No major ISP is going to do that because it creates significant support issues and adds complexity that they do not need. In VM’s case, “modem mode” is a perfectly fine substitute for those who really do wish to use their own router. You are also assuming that these retail brands are actually any good themselves. As a former Ubiquiti user I’d disagree.
Most ISP routers contain valuable diagnostic capability which is useful when the customer is crying wolf about one thing or another. Most valuable is some form of router-based speedtest that can verify performance without using the customers’ old, misconfigured or broken equipment. This is also used as part of Ofcom’s performance monitoring.
ISP routers are not necessarily cheaply made. Some are also market leading, for example you’d have had to spend multiple hundreds of pounds to get anything that performed as well as the tri band EE Smart Hub 7 Pro at its launch. As a freebie item it’s still an excellent performer, and its revised version with 10G WAN and LAN ports would once again be hard for a customer to replace at reasonable cost.
Ivor says “You are also assuming that these retail brands are actually any good themselves. As a former Ubiquiti user I’d disagree.”
Disagree, I have LATEST Ubiquiti WIFI7 AP and another brand “consumer” router running custom firmware (yes my one was like £700 and got on discount for £569, but other models far cheaper exist from same manufacturer).
The firmware on that vastly exceeds anything on Ubiquiti or other models. The ability to do DNS over TLS, DNSSec, VLANS and a host of country blocking, Firewall ACLs, Security in depth defence stuff. Simply too much to list here as to what it offers.
The latest EE router is fine if thats all you can afford. I’ll say it again, if you know what you are doing you’d never use an ISP supplied router. Other smaller ISP’s supply fairly decent routers for those not comfortable with using a decent 3rd party router and configuring it. ISP routers like EE are built to a cost point. There is no diffence between PPoE on that and my own, as mine does the Baby Jumbo Frames on the WAN connection too giving a useable MTU of 1500 without fragmentation. The processors are also faster and more memory.
@ Ivor — The diagnostics argument doesn’t sit well under this particular article. The Hub 4’s own interface is exactly what customers have been locked out of, and some report that Virgin’s support struggled to understand the problem. A diagnostic tool the customer can’t reach only serves the ISP.
And by your own account, that’s who it’s for: something to check against when “the customer is crying wolf”. A router-based speed test tells the ISP that its line reaches its own box at the promised speed, which is useful when it wants to close a complaint. It’s far less use to a customer whose problem sits somewhere the ISP’s box can’t see, or, as this week, inside the box itself.
Modem mode is a reasonable answer, and that’s rather the point: it’s bring-your-own-router by another name. Virgin’s hub carries the line, the customer’s equipment does the rest, and the line-side diagnostics stay exactly where they were. The support complexity you describe is one Virgin already handles. Offering a choice at sign-up is simply a tidier version of the same thing.
As for retail kit, a UniFi gateway has its own speed test and full (read: exhaustive) logs as well, and the person who owns it can actually get to them. The EE Smart Hub being a ‘good’ router says nothing about the Hub 4, which is the one customers currently can’t get into. Not everyone wants or benefits from the ‘accessible’ layman option, sometimes least of all the ISP when a competent customer can better diagnose the issue at hand than their own staff or their apparently sainted ‘ISP-provided router’.
Fanny – Ubiquiti struggled to get hardware accelerated PPPoE going until relatively recently and I’d wonder how well it works once you’ve turned on all that nonsense. I don’t think it is yet available on all models.
Lycaerix – aside from your post giving off LLM vibes, the diagnostic tools and outputs are intended for the ISP, who isn’t looking at the (deactivated) web interface anyway. That is what SNMP (for DOCSIS), TR069 and USP are for.
The ISP’s responsibility ends at the router. If they can prove that the router is capable of reaching the correct speed then that’s all they need to do. Ubiquiti might offer a “speed test” but it doesn’t use the backends that the ISP and Ofcom require to be used.
So, to repeat myself – no ISP is going to move to a BYOD model or start offering a range of equipment. Some will have deals with the likes of Amazon to provide a customised Eero that gives them the features I have described
Ivor, Ubiquiti did struggle with PPoE acceleration indeed, but I was mainly talking about other security features. I’m not sure if you called DNS over TLS and vaious other security measures “nonsense” or meant PPoE struggles. I really hope you meant the latter, because security and privacy are never nonsense (except for those who want to snoop on URL DNS lookups and other data).
VM offer modem mode on their HFC HUB5 router just not on their fibre router Hub5x. I wouldn’t go with any ISP who forced me to use their router. You have to question why they wouldn’t allow your own router or provide a “modem only” type mode. I’d be as bold to say “snooping” is the reason.
They can snoop fine whether you use their router or not. They are happily recording your ICR whether you’re using DoT or their own DNS via their equipment.
The Hub5x it’s due to their monitoring being built for cable not PON. No idea if they’ve sorted it, needed software stack at nexfibre and their own code changing. They have some access to GG ONTs no idea how much.
Not the DNS lookups as they are encrypted with certs and DNS servers don’t have to be based in UK or keep logs. Yes, things like corporate zScaler can intercept traffic if they know the keys. Nobody is doing http in favour of https now for apps/online.
Other things that you can use blocklists or DNS blocks for are significantly reduced, like cutting down adverts/malware/Cryptomining/New domains/Free hosting domains/Residentail hosting/Tunelling endpoints/data Drop services/DNS Payload Delivery/Decentralised Gateways/Parked DOamins/High Risk TLDs/Threat Intelligence/Domain Generation Algorthims/DNSSec/Specific Top Level Domains/Native tracking by Microsoft/Apple/Google/Amazon/Samsung/LG/Third Party Trackers/Tracking links/Rotating Ad domains/Specific categories of web sites e.g. Porn
Nothing 100% all of the time, but massively helps.
Of course it’s not an ideal situation – but better to not have these Hub 4 routers left open to potential exploits.
What matters is how quickly VM move to patch it quickly and get it rolled out.
It’s been blocked to try and prevent bad publicity to VM as no immediate security hole that can be exploited and cable router manufacturer (Arris) needs to come up with a patch, assuming it’s not EOL. If its EOL or approaching EOL, then VM may have to upgrade customers on HUB4 to HUB5 OR Arris may decide to patch anyway, maybe, with a little financial help from VM. VM have been upgrading customers to HUB5 over past months anyway with invites by email or contract renewal time.
I await the article in a year’s time: “Virgin Media Hub 4 still locked down a year on”.
Anyone else still awaiting modem mode on the hub5x? I’ve finally admitted defeat and have purchased the 8311 community work around.
Trouble is, VM could in the future decide to make it dificult to use devices like WAS-110 – they could actually block today if they wanted/noticed.
I didn’t realise this was an actual issue. Was trying to access mine the other day and I couldn’t
Related questions:
1/ Do any ISPs now embed endpoint monitoring software (for ISP and/or customer use) of the sort that Samknows used to offer in their Whitebox add on monitoring device? Samknows also was offering that capabiolity to ISPs to embed into routers. Samknows were acquired by Cisco and became part of Cisco’s Thousandeyes product (if I understand correctly)
2/ Are any remaining Samknows whiteboxes receiving security updates, or should they be removed (last time I looked they were still working and generating reports)
I’m not sure if you’re exactly asking for this, but when I go to the SamKnows site when connected to my Hub 4, it’ll do a speedtest on the router and on my device.
@Mark Jackson
Any word on this affecting business Hiton Chita units?
I have come across a few this week with the same issue.
I wondered how long it would take before it turned into a ‘I use ubiquiti/unifi btw’ thread..
Still any FTTP connection does allow you to use your own router/firewall. which is always good.
Annoying as losing the config access, I’d rather than then have a gaping hole.
I had similar issues with my Hub 5 in the last few days. I disabled the guest network and wifi channel optimization and the admin GUI is back to normal. I’m guessing that there admin GUI has issues.
This has been driving me crazy. I rebooted the hub and tried a variety of other things. Until your article I had no idea that Virgin Media had turned off access to the admin page deliberately. Thanks for making this public. Now I can stop beating my head against the wall.