DIY Series 110: Setup Guest Network on D-Link Router (TM Unifi)

Info Related to XCPE Android TV Botnet

In November 2026, Google and cybersecurity agencies — including Malaysia's National Cyber Security Agency (NACSA) — warned that over 1.3 million Android TV boxes (such as MECOOL and unbranded boxes made by Videostrong) shipped from the factory with the hidden XCPE (x.cpe) backdoor built directly into their system firmware. Because it is embedded at the factory level, a factory reset or normal app uninstall cannot remove it.

Putting an Android TV box on a Guest Network acts as a digital quarantine to protect your phones, laptops, and personal data if the box is compromised by the XCPE botnet.


How a Guest Network Protects You

• Blocks local network scanning and lateral attacks. Once active, the XCPE malware maps your home network and opens reverse shells to look for other vulnerable devices. A Guest Network with Client/SSID Isolation enabled prevents the TV box from seeing or communicating with your smartphones, computers, or smart home hubs on your main Wi-Fi.
• Protects shared files and local devices. Devices on your main network often share local access to network storage (NAS), printers, security cameras, and smart home controls. Keeping the TV box on a guest network ensures hackers cannot use the box as a stepping stone to access your personal files or home devices.
• Limits credential and data exposure. If your phones and laptops stay on a separate main network, traffic sniffing or local network exploits launched from the TV box cannot intercept your banking sessions, passwords, or private communications.

Important Limitation to Keep in Mind

While a Guest Network protects your other devices, it does not stop the TV box from using your internet connection.

• Residential proxy abuse. Even on a guest network, an infected box can still rent out your home IP address as a residential proxy, meaning cybercriminals could route illegal or malicious traffic through your Unifi internet line.
• What cybersecurity experts recommend. If you check your Android TV box's system apps and find suspicious packages like x.cpe, com.oemservice, or com.abc.nexus—or notice Google Play Protect has been disabled without your permission—both McAfee and NACSA advise disconnecting the box permanently and replacing it with a certified streaming device.

Setup Guest Network on D-Link Router (TM Unifi)

On the D-Link DIR-X3060Z (TM Unifi firmware), the Guest Wi-Fi menu is located inside the WLAN section under Network. Rather than being labeled "Guest Zone," this firmware treats the guest network as an additional SSID.

Access to The Exact Menu Path

1. Log in to the router.
   Open your browser, go to your router's IP address
   (usually @ http://192.168.0.1)
   Sign in with your "tmadmin" credentials.
2. Open the Network > WLAN > SSID Setting.
   Select: 2.4GHz, SSID2
   Set a new SSID Name, e.g.: MyGuest_2.4G
   Click "Submit" to apply the new setting.
3. Open the Network > WLAN > Security.
   Select: 2.4GHz, SSID2
   Set a WPA Passphase, e.g.: Abc@12345
   Click "Submit" to apply the new setting.
4. Open the Network > WLAN > SSID Setting.
   Select: 5GHz, SSID6
   Set a new SSID Name, e.g.: MyGuest_5G
   Click "Submit" to apply the new setting.
5. Open the Network > WLAN > Security.
   Select: 5GHz, SSID6
   Set a WPA Passphase, e.g.: Abc@12345
   Click "Submit" to apply the new setting.

How to Confirm the Guest Network is Activated

• Before: SSID2 & SSID6 are "DISABLE"

• After: SSID2 & SSID6 are "ENABLE"

Check for WiFi Signals on your PC or Phone

• You are now able to see the new networks and connect to the Guest Network.