content: I disagree with a few of these points. The docs list this as the typical means of infection: "...either using the Claymore tool or via a supply chain operation" We don't yet know what 'Claymore' is, but a 'supply chain operation' would be the CIA implanting it either with complicit vendors or by intercepting devices in-transit before they're sold. All-in-all, that's not all that far fetched but probably not what is happening for most people. You often don't need physical or wireless access to compromise a router. Typically, this is when the devices don't protect against something called cross-site request forgery (CSRF). These attacks originate from a site on the Internet, which calls back to your router to make some sort of state-changing action on the device. Often you need to be logged into your router for this to work, because the browser will include your session information along with any requests, even from external locations. That's not always the case though... I've found issues in recent history that don't require you to be logged into the device, although generally it has to be chained together with other vulnerabilities (like debug functionality left on the device, which happens quite often). CSRF is hard to fully explain, but if you want to read up more about it, check out   this. Just to speculate, 'Claymore' could be something like an 0-day in, for instance, the lighttpd web server. You know, a web server developed by a handful of people on a volunteer basis and used on probably a majority of these sorts of devices.