Changing Password on Netgear CG3000D-RD

No, it's not Cox. Does it give you a IP or MAC address of the person trying to log in? 

Please see below. There is no IP or MAC. The router is right next to me with one cord plugged in my laptop and wifi disabled. This is weird. If I change the admin password back to default, The message will go away.

If anyone has the same modem, Please try to change the admin password and look in the event. If you see the same message, Please reply.

When you say you disabled the WiFi, could you explain? I ask because there was debate on if disabling the SSID broadcast actually disables the WiFi all together. Standard practice is no, but Cox has suggested that that with their particular gateways it does. Either way if you have a unknown logging into your router the LAST thing you want to do is change the password to default. Your custom password seems to be keeping a intruder away. 

Also, I assume your logging into the gateway to get the Event log, do you get any error messages when you attempt to? Maybe your browser is sending information to the router that triggers a false alarm? 

Last, is there a way to see a list of connections or routing log? Even if you set the DHCP range to 1 IP, a device can still connect using a static IP. 

1. I go to "Wireless Settings" and uncheck "Enable SSID Broadcast"

2. There is no error message when I try to login. I also suspect the browser and tried different ones (chrome, Firefox, IE ...etc) but the event shows fails attempt to login every second so I don't think it the browser.

3. Here is the new log.

It seems that only disables the broadcast of the wireless and not the wireless itself. Think of it like being unpublished in the phone book. You wont see the name when you scan, but if you type it in manually, you connect right away. How this is even considered a feature is beyond me, and should have been listed under wireless settings. Furthermore, the manual itself doesn't even define it's true nature. See page 1 of this manual. The picture shows it labeled as "Enable SSID Broadcast" while the description calls it "Wireless Access Point".

I would guess who ever was connecting to your wireless before you disabled the SSID broadcast is still trying to connect, maybe for the very purpose of enabling the SSID broadcast to make it easier for there other devices to connect. Also, since all the gateways have simular names and identical 192.168.0.1 pages its quite possible this is accidental. 

I would suggest adding wireless security to your network(so atleast people can't connect to it) and work on exchanging this gateway for a Motorola SB6141 and then a router at your price point. The Asus RT-N66R is popular these days and you can buy it right at Bestbuy.

As soon as The gateway got in the network, I have changed SSID and Password to a very long long random digits and WPA-PSK(AES), disable SSID broadcast for the wireless security so it is sure nobody can get into the wireless network even if they're able to get the SSID. The gateway itself is working fine, there is no point to exchange it and spend hundreds of dollars to buy a different router. I just wonder Why the failed login messages appear. After looking carefully at the log, I realize that The message shows up per second, Probably not human work but a server try to connect to it which is Cox. I tried to chat with tech support, but the agent didn't know what I was talking about, all he's done was mentioning wireless password. If anyone happens to find out the reason, Please post it here.

Do you have any software like the Netgear NetGenie or something maybe that is trying to access? If not, the only other automated attempt at access is a trojan (on a computer on your network) or a bot somewhere on the web trying to hack remote access, so be sure to check for that as well and make sure it's disable. 

Curious though, if you only have 1 device and no need for wireless, why do you have a gateway and not a normal modem? Do you plan on adding wireless later?