Is TR-069 a security risk?

Question

My ISP provides a combo box (ONT + router + switch + Wi-Fi) which they can manage remotely, likely using TR-069. They automatically push default configurations to the device. After I do a factory reset, and change the root account password, they can even override the password with theirs once the fiber optic cable is plugged in. User's changes after that remain, though.

Do they get complete control over the device? If it is the case, it is most likely a security risk if I use that box in a production environment.

Answer 1

Potentially, any access to a router is a security risk, doubly so when it is for someone outside your company.

Most TR-069 implemenations allow the ISP to do anything. If you don't trust them substantially (I wouldn't) you need to isolate the router from your network - put your own router/firewall in between. Most often, the best option is to get the ISP router in the "public routing" configuration - simple routing between the Internet access and your allocated public subnet - and connect that to your own router/NAT/firewall box.