How long will my router get security updates?

There is no single number, because every router maker starts the clock at a different moment. NETGEAR stops updates three years after it stops selling a model. eero guarantees updates for at least five years from the day you bought yours new from eero or Amazon. ASUS and TP-Link now publish a fixed end date for each model in some countries. Google publishes nothing, and its own release notes show the original Google Wifi has had no new software since September 2022. So the useful question is not how long routers last, it is which clock your router is on and where its date is written down.

Why the "three to five years" answer misleads

The figure you will see most often is three to five years. It is not invented, but it hides the part that matters: three to five years from when? A router bought new on the day it launched and the same model bought from a clearance shelf two years later can reach the end of support on the same day, because for most makers the clock belongs to the model, not to your box.

Phones work this way too, as how long phones get security updates shows, and the advice there carries over: work out the end date, not the headline number. The difference is that a phone tells you its last patch date in settings. Most routers never tell you anything. They keep routing traffic and broadcasting wifi long after the last fix has shipped, which is exactly why so many are still plugged in.

The evidence that this goes unnoticed is old but blunt. In June 2020 the German research institute Fraunhofer FKIE tested 127 home routers from seven large vendors sold in Europe. 46 of them had not received a security update in the previous 12 months, and one had gone more than five years without one. Not a single router in the test was free of known flaws.

Every big router maker, in one table

Each row below comes from the maker's own support pages. Where a maker publishes per model dates, a few examples are given so you can see the spread.

Two things stand out. First, eero is the only one of these whose promise starts from your purchase rather than from the model, which makes a new eero bought late in a model's life the safest bet on the table. Second, the dated lists are published for one country at a time, because a law in that country required them. The hardware is usually the same elsewhere, so a date published for Australia or Singapore is a fair guide to the same model and hardware version where you live, but it is not a promise made to you.

Three clocks, and how to read yours

Every router you can buy falls on one of three clocks, and the arithmetic is different for each.

• Last sale plus a fixed period (NETGEAR). You cannot know the end date when you buy, because the model is still on sale. Once NETGEAR stops selling the model, add three years. A model bought new in its final year on sale has about three years left; one bought at launch may have many more.
• Your purchase plus a fixed period (eero). Five years from the day you bought it new, as long as you bought it from eero or Amazon. Bought from another shop, you get the listed date instead. Bought used, assume the listed date, because the five years belonged to the first owner.
• A printed end date (ASUS, TP-Link and a growing list of others). The simplest kind. Find the model on the maker's support period page and read the date. If it has already passed, you have your answer.

The first eero shows how this plays out. The first generation of eero went on sale in 2016 and stopped getting security updates in 2022, after the company's promise of at least five years from when it left the market had run out. eero said the devices would keep working but "could become vulnerable to future attacks."

The laws that now force a date

Routers are getting printed end dates for the same reason phones did: governments started requiring them.

Routers sit squarely inside the UK rules. The government's guidance lists what is left out (desktop computers, laptops and tablets without a cellular connection, among a few others) and routers are not on that list, which is why a laptop has no published end date in the UK, as covered in how long laptops get security updates, while the router next to it should. The EU rule is the first to set a minimum length rather than just a duty to publish one, and it will not apply until the end of 2027.

What happens when support ends

Nothing you can see. The router carries on working, and every maker above says so. What changes is that each flaw found from then on stays open for good, on a device that faces the internet around the clock.

The FBI spelled out the result in a public service announcement on May 7, 2025, titled "Cyber Criminal Proxy Services Exploiting End of Life Routers." It said end of life routers had been breached using variants of TheMoon malware, which "does not require a password to infect routers," and which lets criminals install proxies so their crimes appear to come from your connection. The FBI added that routers dated 2010 or earlier likely no longer receive updates. If the kinds of malware and what each one does is new ground, the short version is that a proxied router works for someone else while still working for you.

A compromised router can also quietly change where your devices look up web addresses, which is why DNS hijacking usually starts at an out of date router.

There are exceptions in both directions, and they mark the limits of this page. TP-Link says end of service products no longer get security updates, yet it has shipped patched firmware for a few of them, including the Archer C7 (EU) V2 and the TL-WR841N (MS) V9, when a flaw was serious enough. ASUS and TP-Link both say support may be extended past the published date. Treat those as luck, not a plan.

What to do with the answer

1. Find the exact model and version. It is on the label underneath or on the back, and in the router's admin page.
2. Look it up. Search the maker's site for its support period, security update or end of life page. ASUS also keeps an end of life list; a model on it no longer gets firmware updates.
3. Check the latest firmware date. If no date is published, the date of the newest firmware on the model's download page is your best clue. Nothing for a year or more is a warning sign, not proof.
4. Still supported: install what is waiting and turn on automatic updates, the steps in which updates to install now and which can wait. Change the admin password if it is still the printed one; a passphrase of four random words is long enough to meet the FBI's 16 character minimum.
5. Past its date: replace it. While you wait, the FBI's advice is to turn off remote management in the admin page and reboot.
6. Choosing the replacement: treat the published end date as part of the spec, alongside the wifi standard covered in what the 2.4, 5 and 6 GHz bands trade against each other. A new router in a cupboard will still disappoint, so where the router sits is worth twenty minutes on the day it arrives.