Old Routers Pose Security Risk, Warns Which?

Consumer group Which? has issued a warning about unsecured routers that can no longer receive firmware updates.

The group said that its investigation found these old routers are often unsecured or have weak passwords, which coupled with a lack of updates and network vulnerabilities, poses a real risk.

The group had in December 2020 surveyed more that 6,000 adults to discover what routers they were using at home. It discovered that up to 7.5 million Brits could be using a router that is over five years old, and which is no longer being supported with firmware updates.

Router vulnerabilities

Which? said that it sent a selection of the most commonly used old devices to security specialists, Red Maple Technologies, to find out just how secure they are.

Of those tested by Red Maple, issues were discovered with more than half, from ISPs such as Virgin, Sky, TalkTalk, EE and Vodafone.

“Some of these models haven’t seen an update since 2018 at the latest, and some haven’t been updated since as far back as 2016, which could affect 6 million of these users,” said the group. “Without firmware and security updates, there’s no guarantee that security issues will be fixed. Routers might sit in the corner of the room collecting dust, but they’re a vital part of every day life.”

The main issues found with the old routers are weak default passwords – these passwords can be easily guessed by hackers, are common across devices and could grant someone access.

Another common problem found was local network vulnerabilities. This a lower risk vulnerability, as it requires a hacker to be in the vicinity of the router, but it could allow someone to gain complete control of your device.

Another issue found was a lack of updates. Firmware updates are important for both performance gains, but also to tackle security issues when they arise.

No updates

Most of the routers we looked at had not seen a security update since 2018 at the latest, with no guarantee of a new one in the near future. The routers on test weren’t all bad, though.

But it seems that while some routers were not updated since 2018, old routers from BT and Plusnet (which BT owns) had been recently updated and the specialists did not find any unfixed vulnerabilities or weak default passwords.

Which? provided a list of routers that it has discovered problems with. It recommends asking the ISP for a new router as soon as possible.

But it warned that only Virgin Media tends to give free upgrades. Other ISPs tend to levy a charge.

If this is the case, it said users should consider leaving their ISP if out of contract.

It should be remembered that security issues with routers have been a common theme for the best part of the past decade.