Routers and firewalls after end of support: when to replace them and what the KEV catalog is

The short answer: Once a device reaches end of life (EOL), the manufacturer will no longer provide firmware fixes—even for vulnerabilities known to be actively exploited. Find the exact model designation, including its hardware revision, look up the manufacturer’s end-of-support date and the date of the latest firmware, and check the model against the CISA KEV catalog. If the device is past EOL and its product line appears in KEV, the recommended action is not to „secure it better,„ but to „stop using it." Prioritize routers and firewalls at the network perimeter; internal switches and access points can be replaced as part of a planned refresh.

A router is often the one device in a business that nobody turns off and nobody checks. It sits in a cabinet, its lights are on, and the internet works. If it has been running for five years, that is taken as proof of quality. In reality, the opposite is usually true: five years is often long enough for the manufacturer to have stopped releasing anything for that network appliance.

This is where a router differs from a computer. When support for an operating system ends, a laptop starts displaying warnings. A router says nothing—it looks exactly the same the day before support ends as it does three years later.

What „end of support" means for a network device

Manufacturer documentation often uses two abbreviations that are easily confused:

  • EOS (end of sale) — the end of sales. The model is no longer manufactured, but support often continues.
  • EOL / end of support — the end of support. The manufacturer no longer releases firmware, fixes defects, or maintains the model.

The second date is what matters: the end of sales alone means very little, while the end of firmware releases changes everything.

Why is this more serious for a network device than for a washing machine? A router is not merely hardware; it is a computer running software. Inside it are a Linux kernel, a web server for administration, DNS, DHCP, often a VPN daemon, and remote management services. All of these can have the same flaws as software anywhere else—except that they are continuously exposed to the internet and rarely monitored.

Why a device without firmware updates is a ticking time bomb

For a supported device, the lifecycle of a vulnerability looks like this: someone discovers it, it receives a CVE number, the manufacturer releases new firmware, and you install it. There is a window of risk between disclosure and patching, but that window eventually closes.

For an EOL device, that window never closes. The vulnerability is publicly documented, a working exploit exists, automated scanners have incorporated it—and no fix will arrive. Not even when the flaw is demonstrably being exploited. Vulnerability descriptions for unsupported products therefore carry the label UNSUPPORTED WHEN ASSIGNED, meaning that the product was already unsupported when the CVE was assigned. It is a formal acknowledgement that there will be no fix.

Compromising a router gives an attacker far more than access to a single infected computer:

  • a position in front of the firewall, from which they can see into the internal network,
  • the ability to rewrite DNS settings and silently redirect traffic,
  • a persistent tunnel into the network that survives computer reinstalls and antivirus replacements,
  • VPN credentials if the device terminates VPN connections,
  • a machine that can be added to a botnet and used for further attacks—with your IP address appearing in the victim’s logs.

The last point explains why attackers are interested in old routers even when your business is not an attractive target. They are not interested in you; they are interested in the box.

What the KEV catalog is and why you should know about it

KEV = Known Exploited Vulnerabilities Catalog, a catalog of vulnerabilities with confirmed exploitation. It is maintained by the US agency CISA and is publicly available without registration.

Its defining feature is that a vulnerability is not added to KEV merely because it looks severe on paper. It is included only when there is evidence that someone is actively exploiting it in practice. This distinguishes KEV from databases such as NVD, which contain hundreds of thousands of entries and give a business without its own IT team little indication of what to address first.

As of August 2026 (catalog version 2026.08.27), it contained 1,685 entries, with 280 added during the preceding twelve months. The oldest entry is a CVE from 2002—vulnerabilities more than twenty years old are still being exploited because the affected devices are still running somewhere. A total of 352 entries indicate known use in ransomware campaigns; what such an attack means operationally is explained in the article ransomware in a business: the first 24 hours.

Each entry includes the vendor, product, CVE number, date added, description, required action, deadline, and a ransomware indicator. The required-action field is the most important one for a small-business owner. For an EOL device, it does not say „apply the update,„ but uses wording such as „the product is end-of-life and should be discontinued," or „all hardware revisions have reached end of life and should be retired and replaced."

How to find your model in the KEV catalog

  1. Find the exact model designation, including the hardware revision. It appears on a label on the bottom or back of the device, usually in a format such as DIR-825 rev. B1 or Archer C7 v5. An invoice will not tell you this—the same model name may cover several revisions with different firmware and end-of-support dates.
  2. Find the firmware version and its release date. In the web interface, this information is usually under Status, System, or Administration.
  3. Search the catalog by vendor or model. The table supports full-text filtering and can also be downloaded in CSV and JSON formats.
  4. Read the required action for the matching entry—this is where any EOL notice will appear.
  5. Do not stop at the router. The catalog also covers network-attached storage devices, IP cameras, and video recorders.

Keep one practical point in mind: KEV may list an entire product line rather than a specific device—for example, „Multiple Routers„ or „DSL CPE Devices." If you find your product line, look up the relevant CVE in NVD or on CVE.org; those sources often list the specific affected models. The catalog contains 57 entries for just five brands commonly found in small businesses: D-Link, TP-Link, Zyxel, NETGEAR, and DrayTek.

How to tell whether a device is out of support

What to checkWhere to find itHow to assess it
Model and hardware revisionlabel on the device (rev. A1, v3)There is little point in searching without the revision—each one may have a different end-of-support date
Date of the latest firmwaremanufacturer’s website, Support / Download section for the modelA release more than two years old is a sign that development may have ended
Status in the manufacturer’s lifecycleProduct Lifecycle, EOL, Legacy, or Discontinued sectionAn explicit end-of-support date is the most reliable answer
Mention in a manufacturer advisorySecurity Advisories„Legacy product, replace with newer generation" means there will be no patch
Entry in the KEV catalogCISA catalog, searched by vendor and productExploited in practice; for EOL devices, discontinuing use is usually recommended
Administration interface behaviordevice’s web interfaceHTTP without HTTPS, active Telnet, missing WPA3, or obsolete TLS

If the manufacturer does not publish an end-of-support date, use the date of the latest firmware as a fallback indicator. A device that has received no release for three years is not „stable." It has been abandoned.

What actually happens to unpatched boxes

A manufacturer openly stating that it will not provide a fix. On 4 February 2025, Zyxel published an advisory covering three vulnerabilities—CVE-2024-40890, CVE-2024-40891, and CVE-2025-0890—affecting twelve older DSL models. The advisory states that these products had been „end-of-life for years" and strongly recommends replacing them with newer-generation devices. No firmware was released. CISA added CVE-2024-40891 to KEV on 11 February 2025, with the required action of discontinuing use of the product if no other mitigation was available.

The scale at which such devices are recruited into botnets. An analysis of the network known as Raptor Train by Black Lotus Labs, Lumen’s research team, describes a botnet composed of home and small-office routers, video recorders, network-attached storage devices, and IP cameras. Since the network emerged in May 2020, more than 200,000 devices have passed through it; in June 2023, more than 60,000 were compromised simultaneously. The report explicitly identifies end-of-life devices as an attack surface attracting growing attention from threat actors.

Put the two facts together: devices that manufacturers will not fix, and an organized effort to recruit precisely those devices.

When to replace immediately and when tighter settings are enough for now

You do not need to replace everything at once—classify devices by their exposure:

Replace as a priority — anything at the network perimeter: a router or firewall with a public IP address, particularly if it is past EOL, appears in KEV, terminates VPN connections, or has an administration interface accessible from the internet.

Plan a replacement — internal switches and access points without direct internet exposure. The risk is lower but not zero: a compromised access point gives an attacker a vantage point inside the network.

What to do immediately while waiting for replacement (this reduces the attack surface but does not fix the vulnerability): disable internet-facing administration, Telnet, UPnP, and unused services; remove unnecessary port forwards and DMZ settings; change passwords and delete default accounts; enable automatic firmware updates on devices that are still supported; and isolate risky devices in their own VLAN. These are workarounds, not fixes—the vulnerability remains and waits for another route in.

Then record the date of the next review; twice a year is enough. A device will reach end of support on its own and without notifying you. The prerequisite is knowing what equipment your business has—the article on auditing computer networks and cabling explains how such an inventory is carried out.

What to buy instead

Without recommending a specific model, the decision mainly depends on who will manage the device:

  • MikroTik — routers and switches running the company’s RouterOS operating system. Updates are often available even for older models, and a long-term support branch exists. Configuration, however, requires more expertise.
  • Ubiquiti — routers, switches, and access points managed through a single platform. Straightforward for a business without its own IT department, at the cost of dependence on the vendor’s ecosystem.
  • OPNsense or pfSense on a small industrial PC — a software firewall running on standard x86 hardware. Updates are tied to the software project rather than the service life of the appliance, so the end of hardware support does not automatically mean the end of security patches. It still requires someone to maintain it.
  • Commercial UTM — filtering, intrusion prevention, and VPN in one subscription-based product. Beware of one trap: for some models, an expired subscription means the end of security updates, effectively ending support even for relatively new hardware.

Ask one question that most businesses overlook: how long does the manufacturer guarantee security updates for this specific model, and where is that guarantee documented? An answer such as „for as long as it is sold" means that you do not know the end-of-support date—you simply do not know it yet. The article on the cost of IT management for a small business discusses the wider cost implications.

Kyberzákon: vulnerabilities must be managed systematically, not only after an incident

The new Czech zákon o kybernetické bezpečnosti (264/2025 Sb.), which transposes the European NIS2 Directive into Czech law, moves this issue from something that „should be done" to a process that must be demonstrable. For organizations within its scope, asset management and vulnerability management are not one-off exercises but established procedures—we know what we have, we know what is out of support, and we know when we will replace it. The extent of the obligations varies according to the category into which a company falls; a separate article on zákon 264/2025 Sb. and NIS2 explains who is affected.

Smaller businesses are affected indirectly through the supply chain: a regulated customer will ask suppliers how they manage updates and vulnerabilities. „We have had the same router since 2016 and it still works" is a problematic answer in such a questionnaire.

The same principle applies to operating systems—end of support means the end of patches, whether the device is a server, a laptop, or a box in a network cabinet. The only difference is that an operating system draws attention to the issue, while a router remains silent.

ITHOPE assesses the condition of network devices in businesses in Brno—it checks the actual models and firmware versions, looks up manufacturers’ end-of-support dates, compares devices against the KEV catalog, and recommends what should be replaced as a priority and what can wait for a planned refresh. This is followed by the replacement and configuration of the new router or firewall, along with ongoing management to prevent the same situation from recurring five years later. Related services are described on the IT management and backups and IT for businesses pages.

Sources