I have 4 accounts on my OpenWRT router with * as their password, but I did try with a random password over 256 characters and I couldn't log into them. daemon:*:1:1:daemon:/var:/bin/false ftp:*:55:55:ftp:/home/ftp:/bin/false network:*:101:101:network:/var:/bin/false nobody:*:65534:65534:nobody:/var:/bin/false Still, this is a huge security flaw!