The Most Common Protocol You’ve Never Heard Of

Censys research highlights that CWMP (TR-069) management interfaces are widely exposed on the Internet (over 20 million hosts) and often run insecure or outdated implementations (notably gSOAP), creating risks of remote configuration abuse and remote code execution; prior incidents (Mirai, Misfortune Cookie/CVE-2014-9222) show exploitation is feasible. The report recommends scanning for exposed CWMP instances, applying firmware updates, restarting modems, and restricting corporate access from vulnerable home networks.