KR 한국어로 보기

Is It Really a Problem to Keep Using a Router After Support Ends? What the FBI and CISA Have on Record

Updated 6 min read

TL;DR

  • When a new flaw turns up in an end-of-life router, the maker plans no fix for it.
  • In May 2025 the FBI warned that criminals took over end-of-life routers with remote management turned on.
  • Netgear's advisories list flaws it will not fix in 19 of the Netgear routers safeuntil tracks.
  • If you cannot replace the router yet, install its last firmware, turn off remote management and reboot it.

Yes, it can be a problem. When a new flaw turns up in an end-of-life router, the maker plans no fix for it, and attacks on such routers are on record. On May 7, 2025, the FBI warned that criminals were taking over end-of-life routers with remote management turned on. Netgear's own advisories keep listing new flaws in routers it no longer plans to fix. If you cannot replace yours yet, turn off remote management first.

What the FBI found

On May 7, 2025, the FBI released a public service announcement and a technical alert. Criminals infected end-of-life routers with malware called TheMoon. They then sold access to those routers through services such as 5Socks and Anyproxy. A criminal using such a service goes online through someone's infected router. The websites the criminal visits record the router owner's IP address, not the criminal's.

The attackers used known flaws in routers exposed to the internet through remote management, a feature that came pre-installed on them. A password on remote management did not stop this attack. The FBI says they bypassed it and gained shell access, which lets them run commands on the router.

The technical alert lists 12 model numbers as open to this attack, without a maker name:

E1200, E2500, E1000, E4200, E1500, E3000, E3200, WRT320N, E1550, WRT610N, M10, WRT310N

All 12 are on Linksys's end-of-life list. This site, safeuntil, tracks other Linksys models but not these 12. If you own one, the FBI advises replacing it with a newer model that your maker still supports.

How many entries in CISA's list are end-of-life products

The US Cybersecurity and Infrastructure Security Agency (CISA) publishes a list of flaws known to be used in real attacks. In 111 of the 1,756 entries in the October 23, 2026 version of CISA's list, CISA says the product is, or could be, end-of-life. The most common wording in those 111 entries is "The impacted product is end-of-life and should be disconnected if still in use."

For the makers safeuntil tracks, the list has 20 entries for routers and cameras. In 9 of them, CISA says the product is or could be end-of-life. There are none for Linksys, ipTIME, TP-Link Tapo or Wyze, but no entry does not mean no attacks.

Bars by maker: of CISA's router and camera entries for the makers safeuntil tracks, the share that say the product is or could be end-of-life (open full-size image)
Source: CISA Known Exploited Vulnerabilities Catalog, version 2026.10.23.

An entry in CISA's list does not mean your router was attacked. It records that the flaw was used in attacks somewhere.

CISA requires US federal civilian agencies to remove end-of-life devices reachable from the internet, such as routers and firewalls. In its directive BOD 26-02 of February 5, 2026, CISA says it is aware of "widespread exploitation campaigns" against these devices.

What happens to a flaw found after the end date

Usually it stays open. In its 2026 advisories, Netgear puts an end-of-life mark, "(EoS)", after the name of an end-of-life model. For marked models, it says no security updates are planned and advises a newer Netgear device.

Netgear's December 2025, June 2026 and August 2026 advisories list 11 flaws that Netgear will not fix in 19 of the Netgear routers safeuntil tracks. One flaw can affect several models, and each of the 19 has one to three.

Squares per router: how many flaws Netgear will not fix in each of 19 Netgear routers safeuntil tracks; the R7000 and RAX20 have three (open full-size image)
Sources: Netgear advisories (December 2025, June 2026, August 2026); safeuntil data as of October 26, 2026.

Netgear rates all 11 Medium or Low. Each one works only for an attacker who is on your home network or has admin access. None of the 11 is in CISA's list. But Netgear plans no fix for them on these 19 routers.

On safeuntil's R7000 page, open "Dates and sources" to see "CVEs with no fix for this model: at least 3", a count from these advisories. The three flaw numbers and "No fix planned for this model, says the maker’s 2026-08 advisory" show there too.

What to do with an end-of-life router or camera

First, check whether your model still gets updates. Search for it on safeuntil to see its status and the source, or look at your maker's end-of-life list. If it is end-of-life:

  1. Replace it when you can. The FBI advises a newer model that is still in its maker's support plan. Netgear and TP-Link also advise new hardware for their end-of-life models.
  2. Install the last firmware the maker released. A fact sheet from CISA, the FBI and the UK's National Cyber Security Centre asks for "the latest supported software version when immediate replacement is not possible." Now and then, a maker still ships one more fix after the end date. TP-Link posted fixed firmware for the end-of-life Archer C7(EU) V2, for a flaw now in CISA's list.
  3. Turn off remote management, save the change and reboot the router. The FBI's announcement gives these steps in this order. Netgear says remote management is off by default. So check whether it was ever turned on.
  4. Use a long admin password. The FBI recommends a unique, random password of at least 16 and at most 64 characters.
  5. Keep a camera off the internet. CISA's advisory of July 24, 2025 covers the LG Innotek LNV5110R camera, which is end-of-life and can no longer be fixed. It says to keep the camera off the internet, put it behind a firewall and use a VPN for remote access.
  6. Act on signs of infection. The FBI lists the signs: overheating, connection problems and settings you did not change. Its announcement says to update the router, change the password and reboot it. Its technical alert goes further: replace an infected router with a new model.

FAQ

Does the US directive apply to home routers? No. BOD 26-02 binds US federal civilian agencies only. In their fact sheet, CISA, the FBI and the UK's NCSC "strongly encourage organizations to follow the guidance in the BOD."

Sources

Share

Back to Blog