Hundreds of thousands of home Wi-Fi routers under attack — what to do

If you're using a home Wi-Fi router, Wi-Fi range extender or Wi-Fi USB network adapter that's from 2015 or earlier, it's probably time to put it in a closet and get a newer model. That's because your device may be being hacked over the internet right now.

Serious flaws have been found in hundreds of different models of home networking devices devices made and sold by at least 65 different companies, and cybercriminals are already attacking them. We've got a list of the vulnerable devices at the end of this page.

• Your Wi-Fi router can tell everyone where you live — here's what you can do
• The best Wi-Fi routers
• Plus: Google Chrome just got a killer time-saving upgrade — how to try it now

Many of the affected models were released between 2010 and 2015, and at least a couple date back to 2004. IoT Inspector, the German information-security firm that found the flaws, estimates there are hundreds of thousands of vulnerable individual devices being used today worldwide.

"By exploiting these vulnerabilities, remote unauthenticated attackers can fully compromise the target device and execute arbitrary code with the highest level of privilege," wrote IoT Inspector in its report. 

A known criminal gang is already attacking these devices using the flaws outlined in IoT Inspector's report, which was posted online one week ago (Aug. 16). 

Israeli information-security firm SAM Seamless Network said that it took only two days for operators of a botnet using a variant of the notorious Mirai malware, which knocked out internet access on much of the U.S. East Coast one afternoon in October 2016, to begin launching attacks.

Remote takeover

The particular flaw being exploited by the botnet gang involves remote takeover of the router through the administrative interface, but sadly simply turning off remote access to the admin interface won't fix the issue. 

Just landing on a malicious website on a computer using the router is enough. There are three other serious flaws as well.

These vulnerable devices all using Wi-Fi chips made by a Taiwanese company called Realtek. IoT Inspector told Realtek of the flaws back in May, and on Aug. 13 Realtek released patches for some, but not all, of the vulnerable chipsets. More fixes will be coming from Realtek, but it does not plan to fix the oldest chipsets.

Unfortunately, those patches have to be implemented and fine-tuned by the makers of the vulnerable devices and then pushed out to consumers as new device firmware. 

It's unlikely that many patches are available yet for download or installation, and it may be months before all the updated firmware is available. The oldest devices will probably never be patched.

What you need to do

If you own one of the devices on the list below, here's what to do.

If the device is only a few years old, say 2015 or later: You'll probably get a firmware update in the next few months. 

Check the manufacturer's website now for updates released after Aug. 13, 2021. See if the firmware release notes reference vulnerability ID numbers CVE-2021-35392, CVE-2021-35393, CVE-2021-35394 or CVE-2021-35395, mention Realtek or credit IoT-Inspector for finding flaws.

If so, the firmware will fix these problems. Follow the instructions on the manufacturer's website to download and install the firmware. (Here's how to update router firmware for various brands.) 

If an update isn't available right now, then disconnect the device and use another router or access point until updated firmware becomes available.

If the device was released between 2010 and 2015: You may or may not eventually get a firmware update. As above, check the manufacturer's website for existing firmware updates and follow the instructions. 

If nothing's been released since Aug. 13, 2021, disconnect the device and keep checking the website for the next few months. 

If the device was first released before 2010: You'll probably never get a firmware update. Get a newer device.

List of affected devices