How to Update Your Router's Firmware

You've probably heard "update your firmware" as router-security advice a dozen times, filed it under "sounds important," and never actually done it. You're not unusual — you're the overwhelming majority.

TL;DR

89% of router owners have never updated their router's firmware, per an early-2025 IBM/Instana survey — this is the single biggest reason router botnets keep finding easy targets.
Real vulnerabilities get disclosed, patched, and then exploited anyway for years afterward, purely because most routers never install the patch.
Checking and updating firmware takes under five minutes on most routers, once you know where the setting lives.
Support windows vary wildly by manufacturer — some routers stop receiving security patches after 2-3 years, others for a decade or more.
Once your specific router model stops receiving updates, hardening every other setting still helps, but it's a genuine argument for replacing the hardware.

KEY-STAT: 1 year — how long CVE-2025-29635, a command-injection flaw in end-of-life D-Link DIR-823X routers, sat publicly disclosed before a Mirai botnet variant began mass-exploiting it in 2026 — the exploit code was already public the entire time.

The gap between "a patch exists" and "your router has it"

Firmware updates are the least glamorous part of router security, and it shows: the same IBM/Instana survey found that 86% of router owners have never changed the default admin password, 52% never touched any factory setting, and — the number that matters most here — 89% never update the firmware at all. A patch existing on a manufacturer's website does nothing for a router that never checks for it.

This isn't a hypothetical risk. It's the specific mechanism behind most router botnets: not zero-day genius, but a disclosed, patched vulnerability that the majority of affected devices simply never received.

What happens when firmware doesn't get patched: a real example

In March 2025, researchers disclosed CVE-2025-29635, a command-injection vulnerability in D-Link's end-of-life DIR-823X router series, along with proof-of-concept exploit code. D-Link had already stopped supporting the model, so no patch was coming. For a full year, the vulnerability sat there, publicly documented, unexploited at scale.

Then, in early 2026, a Mirai botnet variant started mass-exploiting exactly that flaw, folding vulnerable DIR-823X units into a botnet used for further attacks. Nothing about the vulnerability changed in that year — what changed is that attackers eventually got around to automating exploitation of a flaw that had been sitting in plain sight the entire time.

Warning

The lesson isn't "D-Link is uniquely bad." It's that once a router reaches end-of-life, the clock is already running — public disclosure plus no patch is a standing invitation, whether or not anyone acts on it in month one or month twelve.

How to actually check and update your router's firmware

I keep a running list of every device on my home network — the same habit that comes from managing a Proxmox homelab, where you can't afford to lose track of what's exposed. The router is on that list, and it gets checked on the same rough schedule as everything else.

Log into your router's admin panel (the same login covered in the router hardening checklist — you should already have a strong, unique password here, not the factory default).
Find the firmware/system update screen — usually under System, Administration, or Advanced → Firmware Update.
Check the currently installed version against your manufacturer's support/download page for that exact model number.
If an update is available, install it — most routers handle this in-panel with a single click, and it typically takes 2-5 minutes including a reboot.
If your router supports automatic updates, turn that on. If it doesn't, this is the step most people skip forever: set a recurring calendar reminder, every 2-3 months, to check manually.

Which router brands actually keep patching, and for how long

Support windows are not uniform across manufacturers, and it's worth knowing where your specific brand lands before you assume "it's probably fine."

Manufacturer approach	Typical support window	Notes
Peplink	No published EOL date	Extends support through hardware revisions rather than cutting off older models
Teltonika	5 years post-production, plus 3 years of critical-only fixes	Formal, published lifecycle policy
Synology	Long-tail security patches	Publishes a documented software lifecycle policy
TP-Link, Netgear, Linksys, Google, Amazon (typical consumer routers)	~3-5 years from release	Industry-average window before firmware support quietly lapses

The practical takeaway: consumer routers from major mainstream brands are usually fine for 3-5 years after release, not from purchase date — a router that was already a year or two old when you bought it has less runway than the box suggests.

What to do once your router stops getting updates

Note

A router past its support window isn't necessarily unsafe the day support ends — but every subsequently disclosed vulnerability for that model will never be patched. Hardening the other settings on the router checklist and using WPA3 or WPA2-AES still reduces exposure, but replacing genuinely end-of-life hardware is the only fix for firmware-level vulnerabilities specifically.

If you're not sure whether your model is still supported, check the manufacturer's support page directly by model number — "the brand still sells routers" doesn't mean your specific model is still receiving updates.

Router firmware update checklist

Log into the admin panel with your (already changed) unique password.
Find the firmware/system update screen.
Compare your installed version against the manufacturer's page for your exact model.
Update if available; enable automatic updates if supported.
If no automatic updates, set a recurring reminder every 2-3 months.
Check whether your model is still within its manufacturer's support window at least once a year.

Frequently asked questions

How do I know if my router needs a firmware update?

Log into the admin panel's firmware/system update screen and compare the installed version against your manufacturer's support page for your exact model number — most routers will also show an "update available" notice directly in the panel.

How often should I update router firmware?

Enable automatic updates if your router supports them. If it doesn't, check manually every 2-3 months — most routers are never checked again after initial setup, which is exactly the gap attackers rely on.

What happens if I never update my router's firmware?

Disclosed vulnerabilities in your specific router model never get patched, and some are later mass-exploited by botnets — as happened with CVE-2025-29635 in end-of-life D-Link routers, exploited roughly a year after public disclosure.

Which router brands have the longest firmware support?

Peplink and Teltonika publish long or open-ended support policies, and Synology maintains a documented long-tail patch policy. Mainstream consumer brands like TP-Link, Netgear, Linksys, Google, and Amazon typically support a given model for around 3-5 years from its release date.