Article is light on the interesting details. How did they came in? Do these routers have open ports and services by default and answer to the Internet in a mean

Article is light on the interesting details. How did they came in? Do these routers have open ports and services by default and answer to the Internet in a meaningful way? Couldn't someone grab different firmware versions and compare them? Looks like they are doing what everyone else is doing and using OpenWrt with a vendor SDK: https://forum.openwrt.org/t/openwrt-support-for-actiontec-t3200m/154720 https://forum.openwrt.org/t/openwrt-support-for-actiontec-t3... What's interesting here is speculated the vendor send a malicious/broken update: https://www.reddit.com/r/Windstream/comments/17g9qdu/solid_red_light_on_t3200_modem/ https://www.reddit.com/r/Windstream/comments/17g9qdu/solid_r... So why is there no official statement from the ISP? If it was an attack shouldn't there be an investigation? I'm not familiar with how this is handled in the USA but this looks really strange. Maybe these machines were bot infested and the vendor pushed an update that broke everything? Maybe it's like in the article and it was a coordinated attack maybe involving ransom and everyone got told it's a faulty firmware update, keep calm? which is also kind of bad, as the customer I'd like to know if there security incidents. Has anyone links to firmware images for these devices? Or any more details?