Brazilian ISP appears to have deployed routers without a Telnet password for nearly 5,000 customers. Devices have been discovered this week by Ankit Anubhav, Principal Researcher at NewSky Security, a cyber-security company specialized in IoT security. The exposed devices are Datacom routers the ISP Oi Internet has provided to customers. The company has notified CERT Brazil, asking the local agency to contact the ISP with their findings and come up with a solution to protect the exposed devices.
Source: https://www.bleepingcomputer.com/news/security/5-000-routers-with-no-telnet-password-nothing-to-see-here-move-along/