The security hole you meet most often in a modem fleet is not a sophisticated vulnerability. Most of the devices run with the factory password, or with a standard password that is the same across the whole fleet, because the company doing the installation had to know that password in order to do its job, and changing it afterwards means an operation on thousands of devices one by one. As a result the number of people who know the password grows over time: former subcontractors, technicians who have left, the subcontractor's subcontractor. Even if none of these people is malicious, a group has formed that knows the structure and the weak points of the network and still has access. In security terminology this is called the insider threat surface, and it appears without anybody stealing a password.

The way to close this risk is not a more complex password but never sharing the password at all. Three things are needed together for that.

The device interface being unreachable from the field. The web, telnet and SSH interface of the modem is made reachable only from the central management system; connecting to the device from a laptop at the branch becomes impossible. Most manufacturer firmware does not allow this; on OpenWrt-based firmware, however, LuCI and dropbear are made reachable only from the management VLAN and only with the central system's certificate. Once there is no situation in which the installer needs to "get into" the device, there is no need to hand over a password either.

A central credential policy. Default username/password pairs are changed across the whole fleet from the panel in a single operation; a complexity rule and a periodic renewal policy are defined, and non-compliance is reported per device. Passwords differ between devices and do not have to be known by any human being.

Temporary, authorisation-based access. When intervention on the device really is needed in the field, the technician is given a time-limited, single-use access token appropriate to their role. The token is valid only for that device and that operation, and it lapses when it expires or when the operation is completed. Everything done is logged under the technician's name. Installation, device replacement and fault intervention are tied to an approval flow; nobody is given permanent authorisation.

Once this trio is in place, the relationship with the installation company also gets simpler: the company does its job, and it neither sees the device password nor can reach the network afterwards. At the end of the contract there is no password list to revoke; what gets revoked is a handful of user accounts.

Role-based access (RBAC) is the complementary layer here. Separate authorisation sets are defined for the administrator, the operator and the installer; the subcontractor account sees only the branches assigned to it, cannot apply a configuration template and cannot delete logs. Time-limited accounts close on their own when the project ends.

In OBIFI Fleet Management the whole of this flow runs in a single panel; the details are on the product page: Modem and Router Fleet Management. For the application on closed camera and alarm networks: the Critical Field Networks solution.