Quantum-Era Threats: Proof-of-Concept on Default Credentials in ISP Cable Modems

Abstract. Context: Critical infrastructures, such as telecommunications systems, are increasingly vulnerable due to poor security practices like the persistence of default administrative credentials in Internet Service Provider (ISP) devices. These flaws are especially concerning in the current landscape, where classical vulnerabilities serve as entry points for more advanced cyberattacks, including those that could be accelerated by quantum computing. Problem: This paper addresses the specific problem of ISP-deployed cable modems configured with default passwords, which expose entire customer networks to takeover. If unresolved, these vulnerabilities allow adversaries to hijack traffic, manipulate DNS, intercept sensitive data, and create large-scale botnets, undermining public trust and national security. Method/Results: To evaluate the scope of the issue, we conducted a Proof-of-Concept (PoC) under real-world conditions, using Shodan for reconnaissance and Hydra for exploitation. Out of 46 devices identified in 14 Colombian cities, 41 (89.1%) were compromised using known default credentials. The results were analyzed through the TRACI taxonomy, which highlighted critical risks to cyber, cyber-physical, and physical assets, insufficient security controls, and multiple adversarial motivations. Contribution: This research contributes empirical evidence of a systemic misconfiguration problem that directly threatens critical telecommunications infrastructure. It validates the need for proactive frameworks such as the MoRCiTO reference model, which emphasizes strengthening classical cybersecurity foundations before integrating quantum-resistant solutions. While the findings are preliminary and limited to a single PoC scenario, they open perspectives for advancing security policies and practices in ISPs and underscore the urgency of addressing basic flaws to build true resilience in the quantum era.