Anyone have an explanation for the following?
I help a friend (who is computer-clueless) with her office and home wireless networks. I installed WGR614v7 routers in both places, and configured them myself to use the default 192.168.1.0/24 LAN address block. Today she called me and said she couldn't access the Internet from any work computers. I went over and found that the router's LAN IP had changed to 10.0.0.1, and since the office machines hadn't been rebooted or ipconfig /repair'ed they couldn't talk to it.
I reset the router to factory defaults and reconfigured it from scratch, changing the WPA passphrase and admin password to 14- character random strings for good measure. I also double-checked the remote-admin setting and confirmed that it is disabled.
I use the same configuration (SSID, admin PW and WPA passphrase) on her home network so she isn't confused by multiple profiles when she takes her laptop home. Given the changes on the work network it was necessary to make the same security changes on the home router.
I walked her through the changes over the phone, and found that her home router was ALSO reset to 10.0.0.1. We successfully completed the password/passphrase changes but I had her leave the router at 10.0.0.1 so I can examine it later this week and check for other suspicious changes.
Questions
Are there any known bugs that would cause a WGR614v7 to change the LAN settings on its own?
Are there any known vulnerabilities that would expose the router to remote hacks even with remote admin disabled?
Are there any known viruses that infect PCs whose primary purpose is to mess with wireless routers?