Possible intrusion?

[Skeptical.me]

Hi,

I woke up this morning and logged on to my iMac and the browser was open with the RT-AX88U's (Merlin) page open. It stated that to login to the page I had to sign out of another logged-in session elsewhere. But I wasn't logged into any other session.

Does this mean someone connected to my router accessed it? And if so how can I find out?

I appreciate any help.

 

[L&LD]

A hacker wouldn't need a computer on the network to try to get into the router.

How many teens do you have in the house?

 

[dosborne]

It stated that to login to the page I had to sign out of another logged-in session elsewhere

It happens sometimes if you close a session or open multiple tabs. Usually nothing to worry about

 

[cooloutac]

Hi,

I woke up this morning and logged on to my iMac and the browser was open with the RT-AX88U's (Merlin) page open. It stated that to login to the page I had to sign out of another logged-in session elsewhere. But I wasn't logged into any other session.

Does this mean someone connected to my router accessed it? And if so how can I find out?

I appreciate any help.

that happens when someone logged into the router from another ip and never logged out. you have to reboot router or log in from that ip and log out. not sure why a page would be open on your pc does anyone have access to it? MIght want to change passwords. to check the login history you would have to enable firewall logging I believe. not quite sure if it specifies webui logins though never checked might be noisey. you can test it and then have it for future reference. you can also enable https only and specify a specific IP for webui access.

 

[thecheapseats]

<snip>Does this mean someone connected to my router accessed it? And if so how can I find out?

get the router's syslog - go over it (if it still exists intact) and look for continuity in time from your last known access until now... if the log is not contiguous or truncated in places or missing altogether that may be a sign of a compromise... of course as suggested - new passwd... above all - don't panic...

 

[kernol]

Hi,

I woke up this morning and logged on to my iMac and the browser was open with the RT-AX88U's (Merlin) page open. It stated that to login to the page I had to sign out of another logged-in session elsewhere. But I wasn't logged into any other session.

Does this mean someone connected to my router accessed it? And if so how can I find out?

I appreciate any help.

I have had a similar experience once before on a Mac - where the settings had defaulted to reopen all apps that were open when the Mac was shutdown [and they often reopen minimised]. On reflection I had not logged out of the webui - but shutdown when it was minimised. No idea why the webui did not simply auto-logout after the timeout period had elapsed.

This problem may be made worse now with the MAC randomising mac addresses - and frequently getting different ip's from DHCP?

 

[RMerlin]

Webui sessions expire after one minute of inactivity.

 

[Skeptical.me]

Wow, thanks for all the replies.

I have reset the password just to be safe. There are three people in the house but only I use this network, the others have their own. And they haven't accessed mine, nor do they know my passwords.

Thanks for the reassurance and guidance, greatly appreciated.

 

[cooloutac]

Webui sessions expire after one minute of inactivity.

not necessarily. I've many times logged in with ethernet to change some settings. then long afterwards try to log in from wifi and got that same error. I would literally have to log back in to ethernet with same ip then manually log out. I notice with merlin firmware though if I let it sit idle, it does usually auto log me out, I thought that was something only your firmware did cause I never noticed that on stock but I could be wrong. This is also from the same pc so the above poster might be on to something with the dhcp server and randomize macs possibly causing issues as well.

 

[RocketJSquirrel]

I see a GUI setting for Auto Logout (minutes) on the Administration page System tab.

 

[cooloutac]

I see a GUI setting for Auto Logout (minutes) on the Administration page System tab.

on stock firmware? test for yourself. log in through ethernet. then pull out the ethernet plug before you go a minute idle. and then try to log in wirelessly from another ip after longer then 1 minute on the same pc and see what happens. I haven't tried to recreate this, but I'm not lying when I say its happened to me. I'm not surprised by the OP's post although you seem more skeptical then him. Definitely more then me. Get the pun? hehe.