Vulnerable routers are being actively exploited, and some have been tied to Russian cyber operations and criminal proxy networks.
Most people never think about their router or Wi-Fi until the internet goes down.
That is exactly why it has become such a dangerous blind spot.
Your router sits at the edge of everything. It connects your office, your home, your laptops, your phones, your printers, your smart TVs, and often your remote work tools to the internet. If that device is outdated, poorly secured, or no longer supported, it can become an easy target for hackers looking to intercept traffic, steal credentials, or quietly redirect users to malicious destinations. Federal agencies have made it clear that vulnerable home and small-office routers are being actively exploited right now.
This is not just a business issue. It is a home issue too.
A lot of business owners and remote workers use the same internet connection for company email, cloud apps, banking, smart devices, and family browsing. If the router in that house has been compromised, the problem does not stay inside the router. It can affect every device and every account behind it. That is what makes this warning so important for both small businesses and families.
What is happening
Recent federal warnings say Russian GRU cyber actors have exploited vulnerable routers worldwide, including small-office and home-office devices, to manipulate DNS settings, intercept traffic, and steal passwords, authentication tokens, emails, and other sensitive information. In plain English, attackers were using compromised routers to silently redirect internet traffic through infrastructure they controlled.
There is also a separate but related problem involving older unsupported routers. The FBI has warned that end-of-life routers are being compromised with variants of TheMoon malware and used by cybercriminal proxy services to hide illegal activity. That means some old routers are not just vulnerable. They are being folded into active crime infrastructure.
If your router is over 5 years old, it is time to replace it
A practical rule of thumb is simple: if your router or Wi-Fi equipment is more than 5 years old, it should be seriously evaluated for replacement.
That does not mean every 5-year-old router is automatically unsafe. But it does mean the odds go up that it is running outdated Wi-Fi standards, older firmware, limited security protections, or has reached the end of meaningful support. Routers dating back to 2010 or earlier are especially likely to be unsupported and exposed.
Routers specifically named in recent warnings and related coverage
This is not necessarily the full universe of affected routers. Some of the published model lists were described as likely incomplete, and one federal alert referenced malware activity affecting roughly 1,200 device models across several brands. The lists below reflect the router models that were specifically named in recent warnings and related coverage.
TP-Link models specifically named
- MR6400
- Archer C5
- Archer C7
- Archer C20
- WDR3500
- WDR3600
- WDR4300
- WR740N
- WR740N / WR741ND
- WR749N
- MR3420
- WA801ND
- WA901ND
- WR1043ND
- WR1045ND
- WR840N
- TL-WR840N
- WR841HP
- WR841N
- WR841N / WR841ND
- WR842N
- WR842ND
- WR845N
- TL-WR849N
- WR941ND
- WR945N
Older Linksys and Cisco-branded Linksys models that deserve immediate attention
The article you shared highlighted older Linksys and Cisco-branded Linksys routers that have been widely cited in coverage of the FBI's end-of-life router warning. If you still see one of these model numbers in an office, home office, or home network, that is a strong sign the device should be reviewed and likely replaced.
- Cisco M10
- Cisco Linksys E1000
- Cisco Linksys E1500
- Cisco Linksys E1550
- Cisco Linksys WRT610N
- Linksys E100
- Linksys E1200
- Linksys E2500
- Linksys E300
- Linksys E3200
- Linksys E4200
- Linksys WRT310N
- Linksys WRT320N
Other router models specifically named in the 2026 malware warning
D-Link
- DIR-818LW
- DIR-850L
- DIR-860L
NETGEAR
- DGN2200v4
- AC1900 R7000
Zyxel
- EMG6726-B10A
- PMG5617GA
- VMG1312-B10D
- VMG1312-T20B
- VMG3925-B10A
- VMG3925-B10C
- VMG4825-B10A
- VMG4927-B50A
- VMG8825-T50K
Why this matters for both the office and the home
Many of these routers are still sitting in homes and small offices because they seem to work fine. That is the trap.
A router can still appear to work normally while exposing your traffic, weakening your security, or being used as part of a larger criminal or state-backed operation. A small business owner may be using an aging home router to access Microsoft 365, QuickBooks, file shares, or remote desktops. A family may be using the same router for online banking, work, school, and smart-home devices. If that router is compromised, the exposure can spread across everything behind it.
What should you do right now?
First, identify the exact model number of your router.
Second, if it is on one of the lists above, or if it is more than 5 years old, treat that as a warning sign.
Third, check whether the manufacturer still provides firmware updates and whether the product is still supported. If it is end-of-life, the safest move is usually replacement, not wishful thinking.
Fourth, if the device is still supported, install the latest firmware, change the default administrator password, and disable remote management unless you truly need it.
And fifth, if you use the router at home for any work-related access, treat that home router as business-critical equipment, because that is exactly how attackers are treating it.
Official manufacturer support pages
Use the official support pages below to check firmware availability, product support status, or end-of-life information.
- Linksys Support
- TP-Link Download Center
- D-Link Support
- NETGEAR Download Center
- Zyxel Download Library
- Zyxel End-of-Life Information
The bottom line
Your router is not just a box with blinking lights. It is one of the most important trust points in your home and business.
When it is outdated, unsupported, or poorly secured, it can expose everything behind it. The recent federal and allied warnings are a reminder that this is not theoretical. Vulnerable routers are being actively exploited, some campaigns have been tied to Russian military intelligence, and older unsupported devices are being pulled into cybercrime proxy networks. If your router is over 5 years old, or if it appears on one of the lists above, now is the time to replace it before it becomes the weak point that exposes your network.
Call to Action
Not sure whether your router or Wi-Fi setup is still safe? Contact First Class Networks for a cybersecurity risk review and make sure your office and home networks are not leaving the door open to attackers.
