More than half of the home routers tested in a major 2020 security study had at least one known, publicly listed vulnerability. The manufacturers already knew. They just didn’t tell you.

Marcus Chen, a 41-year-old accountant in Portland, hadn’t touched his router settings since 2019. The technician set it up, it blinked green, and life moved on. His router sat behind the television for four years, quietly running firmware that hadn’t been updated since the Obama administration’s second term. When a friend in IT finally looked at it, she found three documented CVEs — publicly listed security holes — sitting wide open on a device handling his banking, his kids’ school accounts, and his home security cameras.

Marcus isn’t careless. He’s normal. And that’s exactly the problem.

The Device You Forgot About Is the One That Got You

Think of it this way: your router is the front door to everything in your house that connects to the internet. Your laptop, your phone, your smart thermostat, your fridge. Every single one of them trusts the router completely. If that door has a broken lock, it doesn’t matter how strong your passwords are or how carefully you avoid sketchy websites. Someone can walk straight in through the hardware.

The 2020 Fraunhofer Institute study tested 127 home routers from major brands including ASUS, D-Link, Linksys, Netgear, TP-Link, and AVM. Researchers found that 46 out of 127 devices had never received a single security update from their manufacturer. Not one. Let that land for a second: nearly four in ten routers were essentially abandoned by the companies that sold them, left running with known holes that anyone with basic tools could exploit.

And here is what this actually means for you: those vulnerabilities don’t expire. They sit there, catalogued in public databases, waiting.

Did You Know: The CVE (Common Vulnerabilities and Exposures) database at cve.mitre.org is completely public. Anyone can search your router model right now and see exactly which security holes have been documented. Researchers use it. So do the people you don’t want in your network.

Why Your ISP Has Very Little Incentive to Tell You Any of This

When a Deutsche Telekom customer base was hit in 2016 by a Mirai botnet variant targeting a specific router vulnerability, nearly a million devices went offline. The vulnerability had been documented months earlier. Updates existed. Most customers had never been notified.

Ask yourself why they don’t advertise this part.

ISPs lease routers to customers as a convenience service. Replacing or updating those devices costs money. Sending out security warnings creates support call volume, generates bad press, and occasionally triggers regulatory scrutiny. The business logic for staying quiet is, unfortunately, coherent. Your security is not their quarterly earnings problem.

Here’s the harder question you should be sitting with: if your ISP knew your specific router model had a CVSS severity score of 9.8 and said nothing, what does that tell you about who they’re actually working for?

That is not a rhetorical question. Read your ISP’s terms of service and find where it says they are responsible for the security of the hardware they provide. I’ll wait.

The Volt Typhoon Problem Is Real and It Is Not Abstract

In May 2023, the FBI, NSA, and CISA issued a joint advisory confirming that a Chinese state-sponsored threat group called Volt Typhoon had compromised hundreds of U.S.-based routers, primarily older SOHO (small office/home office) devices, to build a covert communications network on American soil. The routers weren’t the target. They were the tools.

Volt Typhoon wasn’t stealing data from the router owners. They were using compromised home and small business routers as relay points, making their traffic look like ordinary American internet activity. Undetected, distributed, patient. The people whose routers were hijacked had no idea. Their connection might have run a little slow. That was it.

The specific devices named in the advisory included end-of-life Cisco and NetGear models that had stopped receiving manufacturer updates. Devices that millions of people still have plugged in right now because they still blink green, the Wi-Fi still works, and nobody sent them a letter.

Warning: “End of life” for a router doesn’t mean it stops working. It means the manufacturer has stopped issuing security patches. Your router can run perfectly for years after going end-of-life while accumulating unpatched vulnerabilities the whole time. Check your model’s support status at your manufacturer’s website today.

The Update Problem Nobody Talks About

Even when updates exist, most routers don’t install them automatically. Unlike your phone, which pesters you into updating whether you want it to or not, most home routers sit at whatever firmware version they shipped with unless a human manually intervenes. That human is you. Nobody sent you a reminder.

A 2022 study from Broadband Genie surveyed 2,000 UK broadband users and found that 52 percent had never logged into their router’s admin panel at all. More than half had never once looked at the device managing their entire home network. Of those who had logged in, only 14 percent had ever changed default settings or applied an update.

I dug into the actual research so you don’t have to, and here is what I found: the gap between “an update exists” and “the update is installed” on home routers is enormous, and manufacturers have done almost nothing to close it. Some newer routers have auto-update features, but they’re frequently off by default or buried in settings menus clearly designed to be non-obvious.

Marcus, by the way, had an auto-update option available on his router. It was turned off. He never knew it existed.

Pro Tip: Mesh Wi-Fi systems from brands like Eero, Google Nest, and Orbi generally have more aggressive automatic update infrastructure than single-router setups. Eero, specifically, pushes updates automatically with no user action required and has a transparent security disclosure page for past vulnerabilities. If you’re replacing aging hardware anyway, this is a meaningful difference worth considering.

What You’re Probably Running Right Now

The models that keep appearing in security advisories are not obscure. They’re the routers your ISP handed you, the ones still sold at big-box stores, the ones blinking in rental properties and home offices across the country:

  • Netgear Nighthawk R7000 (multiple CVEs, some with CVSS scores above 9.0, some dating back to 2017)
  • TP-Link Archer series (flagged in multiple government advisories, certain models banned from U.S. federal procurement in 2024)
  • Cisco RV series (named explicitly in Volt Typhoon advisory, manufacturer end-of-life confirmed)
  • Linksys WRT series (longstanding admin interface vulnerabilities, inconsistent patch history)
  • D-Link DIR series (D-Link issued a notice in 2024 confirming it would NOT patch critical vulnerabilities in several older DIR models)

If your router is on this list and you haven’t checked its firmware status recently, you are not being paranoid by taking this seriously. You are being reasonable.

Action Step: Go to cve.mitre.org right now and search your exact router model. Look at the CVSS scores. Anything 7.0 or above is considered “high” severity. Anything 9.0 or above is “critical.” If your firmware predates the patch date listed in the CVE entry, that hole is still open on your device.

Your Next 3 Steps

Step 1: Log into your router tonight and find your firmware version. Type 192.168.1.1 into your browser’s address bar (or 192.168.0.1 if that doesn’t work). Log in using your admin credentials. If you’ve never changed them, try “admin/admin” or “admin/password” — and if either of those works, change them immediately, because so can anyone else. Once you’re in, find the firmware version number under Settings, Advanced, or Administration. Write it down or screenshot it.

Step 2: Compare your firmware version to the latest release on your manufacturer’s support page. Go to your manufacturer’s website, search your exact model number, and find the firmware download page. If the version listed there is newer than what you’re running, update right now. The process takes about three minutes and requires clicking one button. If your model doesn’t appear on the support page at all, that likely means it’s end-of-life.

Step 3: Search your model on cve.mitre.org and make a decision based on what you find. If your router has CVEs with a CVSS score of 7.0 or higher and your current firmware predates the patch, you have three options based on budget: update the firmware immediately if a patch exists (free), replace the router with a current model that has auto-update enabled such as Eero Pro 6E at around $180 (mid-range), or switch to a mesh system with managed security updates if you want the most hands-off protection going forward (higher cost, lowest ongoing risk). If your router is on a government advisory list or is confirmed end-of-life with no available patch, replacement is not optional. It’s overdue.

The green light means it’s working. It has never meant it’s safe.