Old Routers Without Firmware Updates: A Security Time Bomb in Your Home

A router that no longer receives firmware updates from its manufacturer can still connect devices to the internet, but it loses its most crucial capability: patching newly discovered security holes. This situation puts millions of households at risk that grows over time, especially because attackers often target vulnerable routers en masse to use as relays for malicious traffic or as part of a global botnet.

According to guidance circulating among security practitioners, there is no automatic mechanism that shuts down a router when support ends. The device will keep working until it suffers a hardware failure. However, once firmware updates stop, the router loses its main defense against exploits discovered later. This does not mean your home will be attacked immediately, but vulnerabilities left to pile up become an ever-wider doorway for malicious actors.

Some manufacturers, such as Netgear, suggest a support cycle of about four to five years. However, there is no definitive benchmark for when a model stops being updated. For users, this is a checkpoint: make sure your device model and revision still receive security updates. If not, the wisest step is to plan a replacement, rather than waiting for an incident to happen.

In Indonesia, this risk is amplified by network device consumption patterns. Many households and small businesses use routers provided by internet service providers (ISPs) whose firmware status is rarely checked. In addition, awareness of replacing devices periodically remains low. Yet a router that is more than five years old and no longer supported can become a weak point in the home digital ecosystem, including for IoT devices such as security cameras and smart home gadgets.

"A router without updates does not mean it will be hacked immediately, but you should start looking for a replacement sooner rather than later," goes the warning commonly issued by cybersecurity experts.

For now, there are several mitigation steps. Disable remote administration features so the router management page cannot be accessed from outside the home network. Use a strong and unique admin password. If possible, enable automatic updates. For those with technical skills, projects such as OpenWrt offer custom firmware, but compatibility with the correct hardware revision must be ensured. Installing the wrong firmware can render the router completely unusable.

The question is, how long are you willing to take the risk? Checking your router's support status today is far cheaper than facing the consequences of a data leak or network abuse later on.