ConfigureHow

Router firmware and the security lifecycle

By Timor Nagy. Published . 8 min read

Your router is the one computer in the house that runs continuously, faces the public internet directly, and never gets patched by hand. Its expiry date is not the day it stops passing traffic. It is the date the manufacturer stops shipping security updates, that date is usually published somewhere, it is usually about four years after launch, and almost nobody looks it up before buying.

The published window is shorter than the hardware

ASUS maintains a table of them. Its wording: "ASUS will offer security update support to the networking products complied with UK PSTI(Product Security and Telecommunications Infrastructure Act) until the date specified below. And extended support may be provided after the stated date." Every tier in that table is four years, and every one expires on 31 December of a stated year. The GT-AX11000 and the RT-AX89X, both flagship models when new, sit in the tier that ended on 31 December 2025. They are eight months past it, still on shelves second hand, still routing traffic, still showing no symptom of anything.

TP-Link starts a different clock: "The defined support period will end 3 years after the product's end-of-life date." That is better for a late buyer and worse for anyone who cannot find out when the model left the catalogue.

Published router support windows, in years Four horizontal bars comparing published security update commitments. ASUS commits to four years from launch, TP-Link to three years after end of life, the EU Cyber Resilience Act to a support period of at least five years from market placing, and to keeping each issued update downloadable for at least ten years. Each bar starts at its own clock zero, which the row label names. Each bar starts at its own clock zero ASUS, UK PSTI table clock zero: product launch 4 years TP-Link, UK PSTI statement clock zero: end of life date 3 years EU CRA support period clock zero: placing on the market at least 5 years EU CRA update archive clock zero: issue of the update at least 10 years 0 2 4 6 8 10 years
Three published commitments and one archive obligation, each measured from a different starting event.
PublisherCommitmentClock starts at
ASUS, UK PSTI table4 years, ending 31 December of a stated yearProduct launch
TP-Link, UK PSTI statement"3 years after the product's end-of-life date"End of life
UK PSTI Regulations 2023A published "defined support period", which may be extended but never shortenedPublication of the statement
EU Cyber Resilience Act, from 11 December 2027"the support period shall be at least five years"Placing on the market

Where the commitment is written down

Two regimes now force the date into public view.

In the UK, the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 were made on 14 September 2023 and came into force on 29 April 2024. They define a "defined support period" as "the minimum length of time, expressed as a period of time with an end date, for which security updates will be provided", and Schedule 1 paragraph 3 requires that it "must be published", in English, free of charge, "without prior request for such information being made" and "in such a way that is understandable by a reader without prior technical knowledge". Sub-paragraph 3(6) is the part with teeth: the requirement is "not met if the defined support period is shortened after the publication of the information". A published date is a floor.

In the EU, Regulation (EU) 2024/2847, the Cyber Resilience Act, entered into force on 10 December 2024. Article 71(2) sets the schedule: "This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026." Article 13(8) says "the support period shall be at least five years", and its recitals name your device explicitly, arguing that where a product "is reasonably expected to be in use" longer than five years, "as is often the case for hardware components such as motherboards or microprocessors, network devices such as routers, modems or switches", the manufacturer "should accordingly ensure longer support periods". Article 13(19) then puts the end date, "including at least the month and the year", in front of you "at the time of purchase". Article 13(9) requires each issued update to stay downloadable "for a minimum of 10 years or for the remainder of the support period, whichever is longer".

None of this is retroactive. Every router already in service was sold under the old rules.

What end of support means in practice

It means the vendor writes the sentence Cisco wrote. Advisory cisco-sa-sbr042-multi-vuln-ej76Pke5, first published 11 January 2023, covering the RV016, RV042, RV042G, RV082, RV320 and RV325: "Cisco has not released and will not release software updates to address the vulnerabilities described in this advisory." One of those flaws, CVE-2023-20118, was added to CISA's Known Exploited Vulnerabilities catalog on 3 March 2025, two years after the advisory, with no patch existing then or now.

Old bugs do not retire. In the catalog released on 31 August 2026, version 2026.08.31, 1,687 entries, 42 name a router product. Nine of those carry a CVE identifier whose year is at least five earlier than the year CISA listed them: CVE-2011-4723 in a D-Link DIR-300 was added on 8 September 2022, CVE-2014-100005 in a DIR-600 on 16 May 2024. CVE-2014-8361, the Realtek SDK flaw in "the miniigd SOAP service", carries the NVD phrase "as exploited in the wild through 2023" and was added on 18 September 2023.

The FBI put the consequence in an alert, I-050725-PSA, 7 May 2025: "Routers dated 2010 or earlier likely no longer receive software updates issued by the manufacturer and could be compromised by cyber actors exploiting known vulnerabilities." And specifically, "some routers at end of life, with remote administration turned on, were identified as compromised by a new variant of TheMoon malware."

How the recruitment actually works

CVE-2023-1389, published 15 March 2023, CVSS 8.8, describes the whole mechanism in one sentence: "the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request." No credentials, no user action, one HTTP request against the web management interface, root. The fix shipped in Archer AX21 firmware 1.1.4 Build 20230219. TP-Link's own note: "TP-Link is aware of reports that the REC vulnerability CVE-2023-1389 in AX21 has been added to the Mirai botnet Arsenal." CISA listed it as exploited on 1 May 2023.

Persistence is what changes the arithmetic. GreyNoise published a campaign it named AyySSHush on 28 May 2025, built on CVE-2023-39780, an ASUS command injection published 11 September 2023: the attackers added their own SSH key to the device and started sshd on TCP/53282. "The backdoor is stored in non-volatile memory (NVRAM) and is therefore not removed during firmware upgrades or reboots." Censys counted 4,504 ASUS devices carrying that indicator on 28 May 2025, and 10,454 at the observed peak on 7 May 2025. Patching a compromised device closes the door and leaves the key.

From one POST request to a node in a covert network Four stacked stages. A scanner sends an unauthenticated POST to the router web management interface. Command injection through CVE-2023-1389 runs code as root. A second chain writes an SSH key into non-volatile memory and starts sshd on TCP port 53282, which a firmware upgrade does not remove. The device then serves as an on-ramp, traversal or exit node. Only stage two is closed by patching. Only stage 2 is closed by a firmware update 1 Reach: unauthenticated POST to the web management interface no password, no user action, one request 2 Execute: CVE-2023-1389, country parameter reaches popen() injected commands run as root; fixed in build 20230219 3 Persist: SSH key written to NVRAM, sshd on TCP/53282 survives firmware upgrade and reboot; a factory reset clears it 4 Enrol: the router becomes routing infrastructure on-ramp node, traversal node or exit node in a covert network Stage 2 needs an unpatched model. Stages 3 and 4 do not care.
The stage that patching closes is the second one, and it is the only one that cares which firmware you are running.

What the device becomes is described in a joint advisory of 23 April 2026 from NCSC-UK, CISA, the FBI, the NSA, Germany's BSI and eleven other agencies: "Covert networks mostly consist of compromised SOHO routers, but they also pull in any vulnerable device they can exploit at scale." Raptor Train "in 2024 infected more than 200,000 devices worldwide". Volt Typhoon's KV Botnet "was mainly made up of vulnerable Cisco and NetGear routers. The edge devices were vulnerable because they were 'end of life' out of date and no longer receiving updates or security patches by their manufacturers." Your traffic is not the target. Your IP address is.

Automatic updates are worth the reboot

The Cyber Resilience Act settles the argument by mandate. Annex I, Part I, point 2(c) requires products to support "automatic security updates that are installed within an appropriate timeframe enabled as a default setting, with a clear and easy-to-use opt-out mechanism". Default on, opt out available, binding from 11 December 2027. Nothing stops you enabling it today.

On ASUS hardware the path is Administration, then Firmware Upgrade, then Auto Firmware Upgrade, and the vendor's own advice is to "set the automatic upgrade time to the time when you are not using the network". ASUS also forces some releases regardless: "When the new firmware version contains important improvement and fix bugs to make sure the router works stably, this version becomes the required firmware version for this model which the router will automatically upgrade to it."

The cost is a few minutes of downtime at a moment you did not choose. Weigh that against the window it closes. The Archer AX21 fix carries a February 2023 build date, before CVE-2023-1389 was published on 15 March and two and a half months before CISA marked it exploited. Devices updating on their own crossed that gap without their owners knowing it existed.

Manual updating is a measured failure. Fraunhofer FKIE examined 127 home routers running the newest firmware available on 27 March 2020 and found 46 that had received no security update in the previous twelve months, one of them none for over five years. Its 2022 follow-up across 122 models found patches "applied in a timelier manner" and hard-coded login data in "a clear decline", while easily guessable passwords had "not changed significantly".

The four settings that decide your exposure

SettingWhere you want itWhy it belongs to this topic
Remote administrationOffThe FBI's own instruction is to "disable remote management/remote administration, save the change, and reboot the router"
UPnPOff unless one device demonstrably needs itCVE-2014-8361 is a UPnP SOAP service still on the exploited list nine years after assignment
WPSOffThe PIN is brute forceable by design; see the WPA2 and WPA3 guide for why the search space collapses
Admin passwordAnything but what is printed on the labelUK rules require passwords to be "unique per product" or "defined by the user of the product" only for products supplied after 29 April 2024

Remote administration is the one that converts a local bug into an internet-wide one. Cisco's RV series flaw lives in "the web-based management interface"; so does the Archer AX21 injection. With WAN management off, an attacker has to already be on your network.

Checking your own model

There is no central register. Johannes Ullrich noted on 7 June 2024 that "As of April, any supplier of internet-connected devices in the UK must file a 'Declaration of Compliance'", and that you go vendor by vendor to read them. ASUS publishes its table as support FAQ 1051929; TP-Link publishes its statements under its UK PSTI page. Ullrich's practical suggestion is worth copying: "I recommend labeling new devices with the purchase date and the end of support date as you receive them."

If the vendor publishes no date at all, treat that as an answer.

When new hardware is the honest answer

Three conditions, any one of which is sufficient.

The published date has passed and the vendor has said what Cisco said. There is no version of "be careful" that substitutes for a patch that will never exist.

The device shows a persistence indicator that firmware cannot clear. GreyNoise's remediation for AyySSHush is "perform a full factory reset and reconfigure manually", after inspecting the authorized keys file. A reset is worth trying once; a device that keeps reacquiring the key is finished.

The model is not in OpenWrt's supported hardware. Third party firmware is a real extension, and OpenWrt 25.12.0 shipped on 5 March 2026 noting that "The hardware requirements did not change significantly. Most devices supported by OpenWrt 24.10 are also supported in OpenWrt 25.12." It moves the patching obligation onto you, permanently, and it only exists for devices someone chose to port.

What the published support end date tells you to do A decision path starting from the vendor's published security update end date. If that date is still in the future, turn on automatic updates and fix the exposed settings. If it has passed, ask whether the model is in the OpenWrt table of hardware: if it is, third party firmware keeps updates coming but the patching becomes your job; if it is not, replace the hardware. A separate note says that any sign of compromise means factory reset first. Start from the published date, not from how the device feels Is the published support end date still ahead? yes no Turn on automatic updates disable remote administration, replace the printed admin password In the OpenWrt table of hardware? yes no Third party firmware updates continue, patching is now yours Replace the hardware no fix is coming Any sign of compromise overrides all three: full factory reset first, then decide. A device with no published date at all is treated as the right hand branch.
The date decides the branch; how well the device seems to be working decides nothing.

The buying rule follows from the same date. A router bought in September 2026 whose published support ends 31 December 2030 is a four year purchase, whatever the box says about Wi-Fi 7, and the number worth comparing across two models on a shelf is that one.

Sources