ESET researchers purchased 16 used enterprise routers from secondary markets and found that nine of them retained sensitive corporate data. The equipment contained authentication credentials, network topology maps, and configuration details that could enable unauthorized network access.
This isn't theoretical risk. Organizations are discarding devices that function as literal blueprints of their internal infrastructure, and anyone can buy them.
At a Glance
- 56% of 16 refurbished enterprise routers contained sensitive data
- Stored credentials included IPsec and VPN certificates plus hashed root passwords
- Some devices had complete network maps showing on-premises and cloud infrastructure
- Research team identified previous owners including data center operators, legal firms, and tech companies
- Several affected organizations did not respond when ESET tried to notify them
Our Analysis: The Forgotten Attack Surface
Security teams spend considerable effort hardening production networks. They deploy EDR agents, configure firewalls, and monitor for anomalous traffic. Yet the moment a device leaves the building, most of that attention evaporates.
The ESET findings highlight a gap between deployment discipline and disposal discipline. Organizations with mature security programs are apparently treating hardware retirement as an administrative function rather than a security function.
The data recovered goes beyond what most people expect. VPN certificates and root password hashes make sense, but network topology maps revealing remote office locations and cloud architecture are more concerning. An attacker with that information knows exactly where to probe and which segments to prioritize.
Several factors make this worse. First, the organizations that didn't respond to ESET's notifications are operating blind to a documented risk. Second, the affected sample included data centers and technology providers—environments with higher-than-average security expectations. Third, these devices came from the secondary market, which means the supply chain is entirely unregulated.
The practical implication: an attacker doesn't need to breach your network if they can buy a map of it for the price of a used router.
What This Means for You
Device disposal needs the same rigor as device deployment. Before any network equipment leaves your control, verify complete data removal—not a factory reset, which typically preserves configuration partitions.
The scope of what's stored matters. Enterprise routers retain VPN tunnels, authentication keys, RADIUS secrets, SNMP community strings, and often copies of certificates used for inter-device communication. A simple reset leaves most of that intact.
For procurement teams: assume any purchased refurbished hardware is already compromised. Rebuild configurations from scratch rather than trusting inherited settings.
Worked Example: What Gets Left Behind
Say you're retiring five edge routers from a regional office. After a factory reset and power-off, they go into storage until an e-waste vendor picks them up. That sounds complete.
What those devices likely still contain: VPN client certificates tied to your main office tunnel, the pre-shared key for your ISP backup link, SNMP community strings matching your monitoring system, and a configuration file describing your internal VLAN structure. If your organization uses zero-trust network segmentation, those routers may also contain policy definitions that map which segments can communicate.
A motivated buyer extracts all of this before the devices reach a landfill. They now know your ISP dependencies, your monitoring infrastructure, and your internal network design. That's reconnaissance that would take weeks of active probing—acquired in an afternoon from equipment you gave away.
The fix: before disposal, run vendor secure erase if available. For devices without secure erase capability, physically destroy the flash storage. Maintain a chain of custody log documenting which device went through what process. Consider using a certified ITAD service that provides verifiable destruction certificates.
Bottom Line
Over half of enterprise routers sold second-hand are walking out the door with your network architecture inside them. This isn't a niche problem affecting careless shops—it's a systematic failure spanning multiple industries and organization sizes. Until organizations treat hardware disposal as a security control rather than an administrative task, the secondary market will continue offering corporate blueprints to anyone willing to pay.
Frequently asked questions
What types of data did ESET recover from the routers?
Researchers found VPN and IPsec certificates, hashed root passwords, customer records, application connection strings, router-to-router authentication keys, and complete network topology maps showing cloud and on-premises infrastructure.
Were the organizations notified before findings were published?
ESET attempted to contact affected organizations multiple times. Some treated it as a serious data security matter requiring investigation, while others did not respond to the notifications.
Does this constitute an active breach?
Not directly. However, sensitive data exposure through device disposal creates conditions for subsequent attacks, including credential reuse, targeted reconnaissance, and physical security mapping.
Can factory resets prevent this?
No. Factory resets typically preserve configuration partitions and stored certificates. Full data removal requires vendor secure erase utilities, complete media destruction, or certified ITAD processes.
What should security teams do now?
Audit your hardware disposal procedures. Verify that network devices are processed through secure erase or physical destruction before leaving organizational control. Document the chain of custody for every retired device.
Source: infosecurity-magazine.com