Repeated "Wrong password for user root" in WiMAX device log

I was looking at the log for Sagemcom Gigaset SX686 device and noticed repeated entries that look like this:

Jun  2 14:25:47 War <EVENT> scm: 048-00-00  Unknown user tried to connect via SSH
Jun  2 14:25:49 War <EVENT> scm: 048-00-00  Wrong password for user root
Jun  2 14:25:51 War <EVENT> scm: 048-00-00  Wrong password for user root
Jun  2 14:25:54 War <EVENT> scm: 048-00-00  Wrong password for user root
Jun  2 14:25:56 War <EVENT> scm: 048-00-00  Wrong password for user root

What does it mean and should I be concerned?

Note that I have setup Mac address filtering on the device and whitelisted only two mac addresses. Nothing is connected to ethernet ports.

user1044501

Posted 2019-06-02T09:53:42.973

Reputation: 13

Answers

You have a valid ip address (internet or interanet) on your wimax device. someone from outside is trying access to your device for some reason. you must:

1- change your default admin access ports like 80,443,22

2-keep your device firmware up to date.

3-use a complex password and change your admin username if is possible.

4-block outside incoming requests with firewall on your wimax device.

Rasool Ziafaty

Posted 2019-06-02T09:53:42.973

Reputation: 166

So it these are coming from the internet side? – user1044501 – 2019-06-02T19:23:46.393

Based on information that you provided to us, yes. – Rasool Ziafaty – 2019-06-02T19:44:04.763