According to a security firm, approximately six million Sky routers had a severe software issue that might have enabled hackers to take control of residential networks.

The issue has been resolved, but it took Sky 18 months to resolve, according to analysts. Anyone who has not changed the router’s default admin password could have been compromised. According to Sky, a large-scale update takes time. “We take our clients’ safety and security very seriously,” Sky added. “After being made aware of the risk, we started working on a solution, and we can certify that a correction has been issued to all Sky-manufactured equipment.”

The following models were affected:

Sky Hub 3 (ER110)
Sky Hub 3.5 (ER115)
Booster 3 (EE120)
Sky Hub (SR101)
Sky Hub 4 (SR203)
Booster 4 (SE210)

These latter two devices, however, are equipped with a randomly generated admin password, making it more difficult for an attacker to exploit. Furthermore, around 1% of Sky’s routers are not manufactured by the firm. Clients who already have one can now request a free replacement.

A software bug discovered by Pen Test Partners analyst Raf Fini would have empowered an attacker to modify a home router merely by sending the user to a fake website via phishing email. Pen Test Partner’s Ken Munro told BBC News that they might then “take over someone else’s online life,” obtaining passwords for financial services and other websites.

Although there was no proof that the weakness had been exploited, he found the time it took to patch it perplexing. “While the coronavirus outbreak put numerous internet service providers under strain, as more people migrated to working from home, it’s just not reasonable to take well over a year to address a readily exploitable security weakness,” he said.