End-of-Life Home Routers: When and How to Replace

Millions of homes and small offices still run routers that stopped receiving security updates years ago, and criminals are quietly taking them over to hide their own crimes behind ordinary home internet connections. In May 2025 the FBI warned that end-of-life routers were being infected with malware called TheMoon and rented out as criminal proxies, and the same month police took down a proxy service built on hacked routers that had run for about two decades. This guide explains what "end of life" means for a router, how to tell whether yours is affected, what to replace it with and how to swap it without losing your connection. It is written in plain English for households, and for the IT helpers, small business owners and remote-work teams who look after home and small office networks. Router settings are covered separately in the Securing Your Home Router Guide.

Key takeaways

End of life means no more security fixes. Once the maker stops releasing firmware updates, every new vulnerability found in that router stays open for good, however carefully it is set up.
Old routers are being actively abused. The FBI's 7 May 2025 warning said TheMoon malware infects end-of-life routers without needing a password, and that routers dated 2010 or earlier are likely no longer getting updates.
You will probably not notice. The FBI lists only subtle signs, such as overheating, connection problems and settings you did not change. The router keeps working while criminals use it.
Checking takes ten minutes. Find the model and hardware version on the label, then look it up on the maker's support site for an end-of-life or discontinued notice and the date of the latest firmware.
Buy on support period, not just speed. UK law already requires makers of connectable products to publish a defined security support period, and EU law expects at least five years for most products.

What is changing and why

Every router runs software called firmware. Makers fix security holes by releasing new firmware. When a model reaches end of life (also called end of support or end of service), the maker stops releasing those fixes. The router does not switch off or slow down; it simply becomes easier to break into each year.

Routers are attractive to criminals for three reasons. They are always on, they sit directly on the internet, and their owners rarely look at them. A hijacked home router gives a criminal a clean, residential internet address that looks like an ordinary household to banks, shops and online services, which makes fraud and account takeover harder to block. Security frameworks recognise this pattern: MITRE ATT&CK records criminals and state groups compromising network devices to use as infrastructure (T1584.008 Compromise Infrastructure: Network Devices) and chaining them as relays (T1090.003 Multi-hop Proxy).

Proxy crime: the FBI says TheMoon lets criminals install proxy software on the router and commit crimes anonymously through it. Victims may later find their address linked to fraud they had nothing to do with.
Botnets: infected routers scan for and infect other vulnerable routers on instruction from a command and control server, as the FBI describes for TheMoon. See the Mirai and IoT Botnet Families Guide and the Botnets Guide.
State use: government advisories have repeatedly described state-backed groups building covert networks from compromised small office and home routers. See the Volt Typhoon Threat Actor Profile and the Flax Typhoon Threat Actor Profile Guide.
Your own data: a router that is taken over can redirect your devices to fake websites or watch which sites you visit, as the overview guide explains.

Official timeline and current status

There is no single end-of-life date for routers: each maker sets one per model. What has changed is how governments and law enforcement treat old routers. Status as checked on 8 November 2026:

Date	Event	What it means
2014	TheMoon malware first found, according to the FBI	A long-running threat that has kept evolving
29 April 2024	UK Product Security and Telecommunications Infrastructure (PSTI) security requirements apply	Makers of connectable consumer products sold in the UK must publish a defined support period, a way to report security problems, and avoid guessable default passwords
20 November 2024	EU Cyber Resilience Act (Regulation (EU) 2024/2847) published, in force 10 December 2024, with obligations phasing in over the following years	Recital 60 says the support period should be no less than five years unless the product is expected to be used for less, and names routers, modems and switches as products often used for longer
7 May 2025	FBI public service announcement I-050725-PSA, "Cyber Criminal Proxy Services Exploiting End of Life Routers"	Official warning to replace end-of-life routers and turn off remote management
May 2025	Operation Moonlander: US and Dutch authorities, with Thai police and industry researchers, dismantle the Anyproxy and 5socks proxy services	Reported to have sold access to hacked routers since at least 2004 and taken over US$46 million; the FBI listed affected end-of-life Linksys and Cisco models
February 2026	CISA Binding Operational Directive 26-02, "Mitigating Risk from End-of-Support Edge Devices", as reported in the press	Directs US civilian federal agencies to inventory and remove end-of-support edge devices, including routers, on a phased timeline; press reports describe deadlines from 3 months to 2 years, so check the CISA directive for exact dates

The CISA directive binds only US federal agencies, but its approach (inventory, replace, then keep watching) is a sensible model for any organisation. Dates and rules may change: check the linked official pages before relying on them.

Who and what is affected

Situation	Risk	Usual fix
Router you bought yourself more than about 8 to 10 years ago	High: likely past end of life, and the FBI says routers dated 2010 or earlier probably get no updates	Check the maker's site; replace if unsupported
Models named in the FBI's 2025 alert (Linksys E1000, E1200, E1500, E1550, E2500, E300, E3200, E4200, WRT310N, WRT320N, WRT610N and Cisco M10, as reported)	Very high: confirmed targets	Replace now and do not reuse
Router supplied by your internet provider	Lower if the provider pushes updates, but old hubs are still retired	Ask the provider whether your hub still gets updates and request a replacement if not
Second-hand or "refurbished" router from a marketplace	Unknown age and firmware history	Check model support status before using; factory reset and update
Small office or home worker router used for company access	Business risk: a compromised router sits in front of work laptops	Include in asset inventory and replacement budget
Old router reused as a Wi-Fi extender or access point	Often forgotten and never updated	Retire it or replace with a supported mesh unit

Finding affected systems and identities

For a household

Read the label: on the base or back of the router, note the brand, model number and hardware version (often shown as "Ver", "V2" or "H/W"). Support status can differ between hardware versions of the same model.
Check the maker's support page: search the maker's website for the model. Look for words such as "end of life", "end of support", "discontinued" or "no longer supported", and note the date of the latest firmware.
Check the router itself: sign in to the settings page (see the overview guide) and find the firmware version and any "check for updates" button. If there has been no new firmware for several years, treat the router as unsupported even without a formal notice.
Look for warning signs: the FBI's list is overheating, connectivity problems and settings changes you do not recognise. Also check whether remote management is switched on and whether there are admin accounts or port forwarding rules you did not create.
Check the login itself: the router admin password is an identity that controls your whole network. If it is still the default from the sticker or a password reused elsewhere, change it now, even on a router you plan to replace.

For an IT team or small business

Inventory: list every router, firewall, access point and cellular gateway in offices, shops and sponsored home offices, with model, hardware version, firmware version and owner. NIST CSF 2.0 ID.AM-01 and NIST SP 800-53 CM-8 cover hardware inventory.
Match against support lists: compare the inventory with each maker's end-of-life notices, and for US federal agencies with the end-of-service list CISA said it would provide under BOD 26-02.
Exposure: check from outside whether router admin pages or remote management services answer on your public addresses; exposed management interfaces are a common entry point (ATT&CK T1190 Exploit Public-Facing Application and T1133 External Remote Services).
Credentials and accounts: record which router admin accounts, cloud management logins, VPN pre-shared keys and dynamic DNS credentials exist, who holds them and where they are stored. These are non-human credentials that outlive staff changes. See the Device and IoT Identity Guide.
Remote workers: ask staff for router model and age as part of home-working checks, or supply managed routers to people with privileged access.

Migration options

Option	Best for	Trade-offs
Ask your internet provider for a current hub	Most households; simplest path	Often free or low cost and updated by the provider, but fewer settings and you depend on the provider's update practice
Buy a new router with a published support period	Households wanting more control or better Wi-Fi	You choose features and support length, but you must keep it updated and set it up securely
Mesh Wi-Fi system with automatic updates	Larger homes, replacing several old extenders at once	Usually updates automatically through an app; often needs a cloud account, so protect that account with a strong password and 2-step verification
Business-grade router or firewall with central management	Small offices, shops, home workers with privileged access	Better logging, VPN and update control; higher cost and needs someone to manage it. See the SOHO and SMB Router Hardening Guide
Keep the old router temporarily	Only while a replacement is on order	Turn off remote management, change the admin password to a long unique one, apply the last firmware and replace within weeks

What to look for in a replacement

Published support period: under UK PSTI rules makers must publish a defined support period and cannot shorten it once published. Prefer the longest period on offer, ideally five years or more from the date you buy.
Automatic security updates: on by default, with no need to visit the maker's website.
No shared default password: a unique password per device or one you set at first use, as PSTI requires.
Modern Wi-Fi security: WPA3 support, with WPA2 for older devices.
Remote management off by default and a published way to report security problems.
A guest network for visitors and smart devices; see the Securing Smart TVs and IoT at Home Guide.

Testing and rollback

Before you swap: note your internet account details, any special settings from the provider (some connections need a username and password or a specific setting), and your current Wi-Fi name. Photograph the old router's settings pages if unsure.
Set up the new router offline first: change the admin password, apply any firmware update, set WPA3 or WPA2/WPA3, and turn off remote management, WPS and UPnP unless you need them.
Swap and test: connect the new router, then check that each device reconnects and that work VPNs, games consoles, printers and smart home devices still work. Reusing the old Wi-Fi name and password speeds this up, but choosing a new password is safer if the old router may have been compromised.
Keep the old router for a week, unplugged: if something essential will not work, you can reconnect it briefly while you solve the problem. Do not run both at once.
Retire the old router properly: factory reset it to erase saved passwords and settings, then recycle it through an electronics recycling scheme. Do not sell or give away a model on the FBI's list or any unsupported router.
For businesses: pilot one site first, keep configuration backups, schedule a change window, and record new admin credentials in your password vault before the old device is wiped.

Risks of doing nothing

Your connection is used for crime: the FBI warns that infected routers are rented out as proxies, so fraud and attacks appear to come from your address.
Your household is exposed: a taken-over router can redirect traffic to fake sites and spy on browsing.
No fix will come: any newly found vulnerability in an end-of-life model stays open permanently.
Infection spreads: infected routers are used to find and infect more routers.
Business consequences: a compromised home or branch router can sit between staff and company systems. Persistent attackers have used network edge devices for long-term access, as the Edge Device End of Life Replacement Playbook explains for organisations.

How to measure progress (for IT teams)

Percentage of routers and edge devices in inventory with a known support end date.
Number of devices past end of support, and days since each passed it.
Percentage of devices with remote management exposed to the internet.
Percentage of router admin credentials that are unique and stored in a vault.
Median days from an end-of-life notice to replacement.

Framework mapping

Framework	Reference	How it applies
NIST CSF 2.0	ID.AM-01; PR.PS-02	Keep a hardware inventory; maintain, replace and remove software commensurate with risk
NIST SP 800-53 Rev. 5	CM-8 System Component Inventory; SA-22 Unsupported System Components	Inventory devices and replace components no longer supported by the developer
CIS Controls v8.1	Safeguards 1.1 and 2.2	Detailed enterprise asset inventory; ensure software in use is currently supported
ISO/IEC 27001:2022	Annex A 8.8 Management of technical vulnerabilities	Unpatchable devices are an unmanaged vulnerability
MITRE ATT&CK v20	T1584.008; T1090.003; T1190; T1133	How attackers take over network devices and use them as relays
UK PSTI	Schedule 1, paragraphs 1 to 3	Passwords, vulnerability reporting contact, published support period

Practitioner checklist

Record the router's brand, model and hardware version from its label.
Check the maker's support page for an end-of-life notice and the latest firmware date.
Replace immediately if the model is on the FBI's 2025 list, dated 2010 or earlier, or has had no firmware for years.
Until replaced, turn off remote management, set a unique admin password of 16 or more characters and apply the last firmware.
Ask your internet provider whether your hub is still supported and request a replacement if not.
When buying, choose a model with a published support period of five years or more and automatic updates.
Set up the new router securely before connecting it, then test every important device.
Factory reset and recycle the old router; never resell an unsupported model.
Businesses: inventory all edge devices with support end dates and track replacement as a KPI.
Report suspected router compromise used for crime to the FBI at ic3.gov in the US, or to your national reporting service.

End-of-Life Home Routers Guide: How to Spot an Unsupported Router and Replace It Safely