Security agencies warn that outdated firmware, default passwords, WPS and remote administration can leave home networks exposed to attackers and malware.
Every home router has a security profile that is shaped less by the box itself than by the settings chosen on the first day. The most important changes are straightforward: replace the administrator login, update the firmware, use modern Wi-Fi encryption, switch off vulnerable convenience features, and move older or unsupported hardware out of service before it becomes a liability. Those steps matter because the known weaknesses are not theoretical. CERT/CC documented in 2011 that the WPS PIN method can be brute-forced far more easily than users would expect, while the FBI has warned that routers from 2010 or earlier may no longer receive manufacturer updates and can be abused by attackers exploiting known flaws.
The first priority is the router login itself. CISA says the default administrator username and password should be changed immediately, and the FBI recommends a long, random and unique password. That password should be kept separate from the Wi-Fi passphrase, because reusing credentials only expands the damage if one of them is exposed. Where the router permits it, changing the username as well as the password provides an extra layer of friction against automated attacks and anyone who can find default details printed on the device or published by the manufacturer.
Firmware is the next critical control. NSA guidance says home routers should be updated to the latest patches, preferably automatically, and should be replaced when they reach end of life. CISA likewise says firmware updates fix defects and security vulnerabilities, and the FBI urges owners to install patches as soon as they are released. That advice is not abstract: the FBI warned in 2025 that cybercriminals were exploiting end-of-life routers, including some with remote administration enabled, and using variants of TheMoon malware to turn them into proxies for criminal traffic.
Wi-Fi encryption deserves the same attention. CISA says the safe choices are WPA3 Personal or WPA2 with AES, while the NSA says WPA2/WPA3 mixed mode can be used where older devices still need support. Both organisations treat legacy options such as WEP, WPA and WPA2-TKIP as inadequate. The Wi-Fi Alliance has said WPA3 improves protection against password-guessing attempts and requires Protected Management Frames, which makes the newer standard materially harder to attack. A strong passphrase still matters, and the guidance varies slightly: CISA recommends five to seven unrelated words of at least 16 characters, the NSA asks for at least 20 characters on WPA3 or WPA2/3 networks, and the FBI says router passwords should be between 16 and 64 characters.
Several settings should usually be disabled rather than merely reviewed. CERT/CC’s vulnerability note on WPS PIN explains that the design flaw reveals when the first half of the PIN is correct, which sharply reduces the effort needed for a brute-force attack. On many routers, the absence of a proper lockout policy makes that worse, so CISA’s advice is to turn off Wi-Fi Protected Setup, particularly the PIN method. Remote management should also be switched off unless there is a specific need, because it allows administration from the internet. The FBI says some compromised end-of-life routers had remote administration enabled, which gave attackers an easy route in.
Universal Plug and Play is another convenience feature that often exposes more than it helps. CISA warns that malware inside a network can use UPnP to bypass the router firewall, so the default should be off unless a device genuinely requires it. Where a games console or similar device needs open ports, manual configuration is preferable to leaving a general-purpose discovery service running. CISA and the NSA also recommend creating a guest network and putting smart-home and other internet-only devices on it, so that less trusted equipment is separated from laptops, phones and other more sensitive systems.
Support status is what ultimately determines whether any of these settings can keep working. The FBI’s 2025 alert draws a clear line: routers dated 2010 or earlier likely no longer receive software updates, and those devices should be replaced if possible. CISA also notes that older wireless standards are a reason to upgrade, while the UK’s consumer connectable product security regime, which took effect on 29 April 2024, requires stronger baseline security from manufacturers, including the removal of universal default and easily guessable passwords. In practice, the question is not only whether a router still functions, but whether the vendor still patches it and makes that support period clear.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
