The average router runs open-source software more than five years old, even after you install the latest firmware

When most users think about updating their router, they typically follow the same routine: accessing the router's admin panel, noticing a notification about a new firmware version, clicking to update, and believing their network is secure. However, the software powering the router often remains outdated and vulnerable. In reality, many routers run firmware based on Linux kernels and open-source utilities that are years old. This is despite the manufacturer's interface appearing modern.

The software supply chain in consumer networking hardware is often flawed. Router manufacturers don't develop wireless drivers or board support packages themselves. Instead, they rely on closed-source binary blobs from suppliers like Broadcom, Qualcomm, or MediaTek. These suppliers provide outdated drivers based on older Linux kernel versions. Consequently, router vendors rarely update the firmware to match newer kernels, leaving the core software architecture stuck in the past.

The Linux kernel and other open-source components that make up consumer routers are often fossilized. Even high-end Wi-Fi 6 routers may use kernel versions that have stopped receiving support years ago. This results in missing out on security improvements and performance upgrades. Additionally, userland utilities like dnsmasq, BusyBox, iptables, and OpenSSL typically rely on outdated versions with unpatched vulnerabilities.

When a critical vulnerability is discovered in a common networking library, it can take months for vendors to patch it, leaving users exposed.

Router vendors often delay security patches for months, if at all. This creates a significant security risk and potentially renders the hardware obsolete on purpose. Manufacturers intentionally sunset software support, forcing users to upgrade their hardware. This is a waste of valuable networking equipment that could still serve well if supported.

Fortunately, users can take control of their router's software. They can audit their current hardware and check the underlying OS, kernel version, and open-source license disclosures. If outdated components are found, considering alternatives like OpenWRT or third-party firmware projects could be beneficial. These projects offer actively maintained distributions with modern Linux kernel patches.

However, support for specific router models may vary. If a flash is unavailable for a particular router, it might be time to invest in a newer device that supports better software maintenance. Simply clicking 'Update' on a stock consumer router often only paints over an aging foundation. True network security demands modern software life cycles, transparency, and ongoing support.