> The only vulnerability here is the possibility of a 0-Day.

That's not exactly uncommon in cheap consumer routers.

No rate limiting is as good as no authentication.

> That's not exactly uncommon in cheap consumer routers.

That's, in my opinion, the only fair criticism available here.

> No rate limiting is as good as no authentication.

Trying to even load some of the links found in Google takes 10's of seconds. That's effectively a rate limit, even if it doesn't temp-ban per IP address.

Someone would have to dump the firmware to find out, but it would be trivial for each device to generate their own salt - making a potential lack of rate limit a non-issue.

> Someone would have to dump the firmware to find out, but it would be trivial for each device to generate their own salt - making a potential lack of rate limit a non-issue.

Salting does nothing to protect against bruteforce attacks, which are what rate limiting defends against. Salting is done to protect passwords in the event the password data is stolen.

The load times are most likely primarily caused either by slow JS or high RTT/multiple requests, either of which could be trivially bypassed by an attacker. Or an attacker could just fire off 100 requests at the same time and saturate the bandwidth anyway, despite a high latency. And any high latency would likely be significantly lower if you happen to be in the same geographic area.

Latency is not rate-limiting.

I'm a big fan of rate limiting (and even rate limit my static pages) but if your password is secure enough, the lack of a rate limit isn't going to help attackers.

I kind of agree with the comment that started this thread -- people that have explicitly decided to expose their consumer-grade routers directly to the Internet probably know about password managers. Even if you do guess the password and compromise the router, all you'll have is some remote office that is getting TLS errors because of your MITM, and best case control of some unpatched Windows 3.1 machine and maybe some developer's local MySQL install happily listening on port 3306 somewhere. That's not great, but it's a risk that some people are willing to take.

> maybe some developer's local MySQL install happily listening on port 3306 somewhere.

And usually with default password because not on the internet. People often forget or underestimate lateral movement and metasploit reverse shell kits.

> The only vulnerability here is the possibility of a 0-Day.

You do realize that the last security update for these routers was in 2019, right? So by zero day, you mean something more like 700 day? Yeah, no way anyone could've discovered a system takeover in the last 2 years, when up against the security prowess of... TPLink?

I think it might be a good idea to edit your original comment, you'll save some face.