# Are vendor 4G routers in machine cabinets a security risk?

Yes. A cellular router installed for remote support connects the machine to the internet over the mobile network, completely around your firewall, so none of your rules, logs or VPN controls apply to it. If the vendor's portal or the router itself is compromised, or its default password was never changed, an attacker lands on your production network. Many of these routers appear on no drawing because they arrived with the machine. Ask every machine supplier in writing whether their equipment contains a modem or cellular router, inspect the cabinets, and then remove it, keep it powered off until a support session is booked, or replace it with your own controlled remote-access path. A network sensor cannot see the 4G link itself, because that traffic never crosses your network; it can only see the router's LAN side, if that segment is mirrored to it.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/are-vendor-4g-routers-in-machine-cabinets-a-risk

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [How do I find hidden remote-access routers in our production network?](https://netsenx.com/en/faq/how-to-find-hidden-remote-access-routers-in-production)
- [How do I protect an old production PC that cannot be patched?](https://netsenx.com/en/faq/how-to-protect-an-unpatchable-pc-in-production)
- [What is a compensating control for legacy OT systems?](https://netsenx.com/en/faq/what-is-a-compensating-control-for-legacy-ot-systems)
- [How do I build an OT asset inventory without active scanning?](https://netsenx.com/en/faq/how-to-build-an-ot-asset-inventory-without-active-scanning)
- [Which OT devices does passive monitoring miss?](https://netsenx.com/en/faq/which-ot-devices-does-passive-monitoring-miss)