Not long ago, an industrial gateway from a well-known brand went on sale. At a recent trade show, a rugged access point with adjustable reflector antennas — engineers jokingly called them "drone wings" — turned heads, and plenty of people asked the same question out loud: what real-world problem does an antenna that reshapes its own coverage actually solve? Stackable switch-shaped boxes appeared in teasers, and nobody was quite sure what they were for.
Antennas, enclosures, port counts — easy to see, easy to argue about. But when I help manufacturers pick an industrial cellular wireless router for a production line, a vehicle fleet, or a remote station, the conversation almost always starts with speed and price, and almost never with security. That is backwards. The hardware gets the attention; the security inside decides whether the site stays online.
Here is what I actually check, in the order I check it.
Start observing the router from the moment it boots.
Secure Boot.The bootloader should verify a cryptographic signature before any code runs. Without it, an attacker with physical access — or a tampered firmware file — has control of the device before you ever log in.
Signed firmware and firmware integrity.Every firmware image should be signed, and the device should verify the signature and checksum before writing it to flash. Ask the vendor directly: "how do I verify that a firmware file is genuine?"
Secure firmware update.Updates should travel over encrypted channels, flash atomically, and roll back cleanly if interrupted. A half-written firmware at a remote site is not a bug report — it is a truck roll.
No hardcoded credentials.This is the single most common way industrial routers get compromised. Scanners constantly sweep cellular IP ranges for default logins like admin/admin. Every unit should ship with unique default credentials.
Password policy.Strong passwords, no shared factory defaults, lockout after repeated failures.
Account management.Separate admin and viewer roles, per-user accounts, and the ability to disable accounts that are no longer needed.
SSH security.Key-based authentication preferred, password auth off or heavily restricted, SSH2 only, configurable port.
Telnet disabled.Telnet sends passwords in clear text. It should be disabled by default — not hidden behind a menu, but not running at all.
Firewall.Stateful, default-deny on the WAN side; only services you actually use should be reachable from outside.
ACL.Management interfaces should be limited to specific source IPs or subnets. On a plant floor, the admin UI does not need to be open to the whole network.
VPN.This is the heart of any industrial cellular wireless router. The 5G cellular router USR-G816 and 4G cellular router USR-G806w, for example, cover PPTP, L2TP, IPsec, GRE and enhanced OpenVPN — with OpenVPN able to connect to three servers as a client while also acting as a server itself, plus one-click import of .ovpn and PKCS#12 certificate files so it works with OpenVPN CloudConnexa, AWS EC2, pfSense and OPNsense. Encrypted tunnels mean the traffic crossing your SIM card is not readable by anyone on the carrier network.
VLAN.Segment the OT network from the office. If the PLCs and the marketing laptops share one broadcast domain, a single infected laptop can reach the line. Separate VLANs, separate rules.
HTTPS.The management interface should be HTTPS-only, with plain HTTP redirecting to HTTPS.
Remote management security.Remote management is a necessity — a fleet of routers at remote sites cannot wait for a truck. But it has to ride encrypted channels, restrict which sources can manage, and log who did what. The PUSR remote platform handles configuration, reboot and firmware upgrade remotely, and it can push real-time alarms — device offline, weak signal, traffic overrun — via email or SMS.
Audit logs.Logins, configuration changes, reboots, firmware changes — all of it should be logged with timestamps and be exportable. You cannot defend what you cannot see.
Vulnerability disclosure and CVE management.The honest question for any vendor: what is your disclosure process, and how do customers find out about a vulnerability in the components inside your router? Check whether the vendor tracks CVEs on the chipsets and software it ships, and make firmware updates a scheduled habit, not an emergency.
One more thing worth saying: certification. Multiple PUSR routers have passed the EU EN 18031 cybersecurity standard under the RED directive.
Before you buy, put these to the vendor:
Before you choose a cellular wireless router, make sure it is one that can answer these questions clearly.
