I haven’t had problems upgrading in at least 4 years. There’s a screen where you click a button to auto-upgrade.
Just get it installed.
Most consumer routers run ancient stacks with all kinds of weird proprietary vendor patches that are tied to a specific kernel version. Looking at you Qualcomm!
However they generally also drop all traffic by default so from the WAN side they look like a black hole. I guess that's "safe" enough for most consumers.
For fun, take a look at the open PRs in the OpenWRT repos. Those people are doing some amazing work but it's also frustrating to see them struggle with things that _could_ be easy if the vendor made some slightly better choices.
I would strongly prefer something like OpenWRT though. Call me paranoid but after the last few weeks I'm increasingly less comfortable with connecting my devices to a blackbox.
There are plenty of out of support systems still in the wild and while I'm not arguing they are completely secure I was under the impression that kernel vulnerabilities generally make a minor exploit in something else worse (chained priv escalation for example) and generally are difficult to exploit on their own. If I'm mistaken I'd love to know
That includes the one port your LAMP stack uses.
Or, the attacker might be originating from the other side of a device, like within a LAN. Malicious employees/house guests/what-have-you could target devices from inside your network where most servers don't have as much protection or have other open ports accessible.
How about forwarding a port for wireguard or ssh?
AFAIK all the backdoors which have been found in some models are only accessible from the LAN side, and if you have an attacker inside the network, it's already too late.
Disagree, I think it's still a good idea to try to mitigate e.g. root escalations via this bug from devices within your network as well, as they could become compromised at any moment via other means and then promote themselves to root.
It shouldn't be though. Just because my smart lightbulb has an RCE and is isolated on its own VLAN with the router doesn't mean it should be able to attack the router and escalate to access my devices on other VLANs. It should only be able to do damage limited within its own vlan.
I'm thinking of what to do myself.
The ghost of android releasing 6 month old patches every month is going to come home to roost.
That would be a bold claim and one I've never heard before. Hard not to be suspicious of it.
This secuirty floor is unlikely to be the only secuirty floor that ever happens to a kernel used by routers.
The point: Consumer routers do not seem to get updates. Ever.
Is that a worry or what?
But what do I know about it beyond that?
Some more commercial ones (pfsense is commercial) use it too like juniper junos.
Of course it does. But it was not affected in this particular case.
at least with an open source os there are more paths forward.
Granted they are pro-sumer devices, not strictly consumer.
I hope that most of these devices actually do update themselves automatically, and people just aren't noticing. (Whether the updates are any good is another matter!)
MIPS and Arm have no security issues ever so never need patching which is an x86 only thing? Or maybe this comment is no more relevant than pointing out not all Arm patches apply to x86?
LLMs are giving script kids nation state level tools and expertise.
Defintely seems potentially better than no updates at all.
How do you know if you have a wide open CVE they're ignoring, like it's claimed ubuntu are doing?
I'd love for that to be true. Unfortunately, a lot of consumer routers are fairly straightforward Linux systems with no particular attempts at hardening.
full disclosure: they're my employer
unfortunately most lack SSH access or a real ability to test the kernel patch version.
Turris [1] has already been updating their routers for years and they continue doing it.
10G looks a little less consumer-y. I'd imagine cisco, arista, etc do security updates if you want to go down that path.
Their features (Glinet's mesh) are not compatible but it does seem better than just drop support totally.
There also seems to be some involvement in the upbringing of openwrt support -- so it's not a hands-off approach, but on the other hand I'm only looking at Flint 2 firmware/OS development.
Additionally, their Flint 3e uses Qualcomm so the route it takes may be different -- though I hope not!!!
Now, if we are talking about my ISP router/modem....... I'd rather not think about it.
PS: Gl.inet also has a router with fiber optic. Not sure how that would work if I wanted to throw my ISP's router/modem out the window.
Every consumer router-wirelessAP I've seen runs linux.
I never see security upgrades for the kernels they use. Not one. Not ever.
Is this something that should be a cause for concern? Even if you don't run a consumer-grade tplink, netgear, asus, whatever router yourself.