A Router Keeps Routing Long After Its Maker Stops Patching It: How to Find the Support Date

Part of the guide: Tech and Audio Buying Mistakes: What Fails and How to Check Before You Buy

A router never announces its retirement. It keeps handing out addresses and keeps its admin page in the same place long after the company that built it shipped the last firmware for that model. Nothing on the device changes on the day support ends.

The date is published, just not where a buyer looks. NETGEAR calls it End of Service, TP-Link calls it End of Maintenance, and ASUS publishes dated security-update windows model by model. The reason to go looking is that an unpatched router is useful to someone else: in a May 2025 public service announcement, the FBI described criminals installing proxy software on end-of-life routers so their traffic carries a victim’s address rather than their own.

What end of service means in writing

NETGEAR states the rule on its End of Service page: “In general, EOS for NETGEAR products occurs three years after the last sale date,” the last date it anticipates the product being available through authorized partners. Then the consequence: “Products that reach EOS no longer receive firmware updates, including important security updates.” Its own FAQ adds that the product “will not receive security updates, making it more susceptible to vulnerabilities.”

TP-Link splits the lifecycle in two. Its End-of-Life Policy says “The End of Maintenance (EOM) date is when TP-Link will no longer provide support or maintenance for a product,” and that “Unless otherwise required by law, the EOM date is usually 3 years after the EOS date,” though it may decide at its discretion to continue longer. After EOM, “the product’s functionality may be limited.”

ASUS publishes the most specific version of the same information, for one market. Its support page for routers certified under Singapore’s Cybersecurity Labelling Scheme gives an end date per model, from 28 February 2025 for a list of older AX models to 30 September 2029 for current ones, and notes that “extended support may be provided after the stated date.” That page was last updated September 3, 2026, checked October 14, 2026.

All three makers tie firmware to a date, not to whether the hardware still works, and two set that date about three years after the model stops being sold.

How to look up your model on the maker site

Start with the label underneath the router, which carries the model number and, on NETGEAR gear, a hardware version. NETGEAR notes that a product showing no version is version 1, and version matters because firmware is published per version.

NETGEAR’s End of Service page has a model-number search and a full list of end-of-service products. Its advisories carry the same flag in line with each vulnerability: the June 2026 NETGEAR Security Advisory, last updated June 12, 2026, marks dozens of models as EoS, among them the R7000, R7800, R8000P, R9000, RAX75, RAX120 and RBR50 and the XR500 gaming router, and states that “Models marked (EoS) have reached End-of-Support phase, and no security updates are planned.” For those models it “strongly recommends that you retire these devices.”

Maker	What it calls the end date	Published rule	Where to check
NETGEAR	End of Service, EOS	About three years after the last sale date	Model-number search and full list on the EOS page
TP-Link	End of Maintenance, EOM	Usually three years after the End of Sales date	End-of-Life Policy, plus the End of Life Products list
ASUS	Duration of security update support	A dated window per model, for the Singapore scheme	Support FAQ listing models under each end date

What an unpatched router exposes

The FBI’s announcement I-050725-PSA, dated May 7, 2025, is about what happens to those devices afterward. It defines the business: “A proxy is a service that relays users’ Internet traffic while hiding the link between users and their activity,” so that a site a criminal visits “does not register their real IP address and instead registers the proxy IP.” Routers dated 2010 or earlier, it notes, likely no longer receive software updates from the manufacturer.

The entry method is the uncomfortable part. The FBI says TheMoon malware “does not require a password to infect routers; it scans for open ports and sends a command to a vulnerable script.” A strong admin password does not close a hole that the firmware never patched.

The signs it lists read like ordinary old hardware: overheating devices, connectivity problems, and settings changes the administrator does not recognize. Its advice is to replace end-of-life devices, apply updates immediately, disable remote management, and use unique random passwords of at least 16 but no more than 64 characters.

An end-of-life router is not just slower. The FBI describes it as inventory for proxy services, infected without needing the admin password.

The Cyber Trust Mark is not a support promise

The label a shopper might hope to lean on is the U.S. Cyber Trust Mark. The FCC’s own public notice DA 26-354, released April 13, 2026, describes it as a “voluntary cybersecurity labeling program for consumer wireless Internet of Things (IoT) products” and names the ioXt Alliance as the program’s new Lead Administrator. The previous administrator’s initial recommendations, that notice says, “are being reviewed by Bureau staff and will be placed on Public Notice for public comment.”

Two things follow, as of our check of FCC documents on October 14, 2026. The mark is voluntary, so its absence says nothing about a product, and the most recent FCC notice we could verify does not state that labeled products are on shelves. In our judgment the maker’s own end-of-service page is the check that exists today.

What to replace it with

The replacement decision is less about Wi-Fi generation than about where the support date is published. A model listed on an end-of-service page with a date that has not arrived is a known quantity; a brand that publishes no such page is not. On coverage, the choice between one router and several nodes is covered in our comparison of mesh systems and range extenders.

Two settings carry over to whatever arrives: disable remote management, which the FBI lists first among its router tips, and set an admin password in the 16-to-64-character range it describes. For the old unit, NETGEAR advises disabling Remote Access if it was enabled, factory-resetting, unregistering the product from the account and disposing of it through a local e-waste recycler.

Buy from a brand that publishes support dates, then write the date down. A router with a known end is easier to plan around than one with none.

The shortlist

Paid links: we earn a commission if you buy through the buttons below, at no extra cost to you. As an Amazon Associate I earn from qualifying purchases.

More: Tech and Audio analyses and how the Fear Index is scored.

Questions people actually ask

How do I tell if my router is end of life?

Find the model number and hardware version on the label, then search that string on the maker’s own support site. NETGEAR has a model-number search and a full end-of-service list, TP-Link publishes an End of Life Products list, and ASUS lists dated security-update windows by model.

How long does a router get security updates?

It depends on the brand, and both common rules key off the sales date rather than your purchase date. NETGEAR says end of service generally falls three years after a model’s last sale date, and TP-Link says end of maintenance is usually three years after the end of sales date.

Is an old router dangerous if nothing seems wrong?

The FBI’s May 7, 2025 announcement says criminals install proxies on end-of-life routers so their traffic registers the victim’s address, and that TheMoon malware infects routers without needing a password by scanning for open ports. The signs it lists are mild: overheating, connectivity problems and settings changes the owner does not recognize.

Does the FCC Cyber Trust Mark tell me how long a device is supported?

Not in anything we could verify. The FCC’s April 13, 2026 notice describes a voluntary labeling program for consumer wireless IoT products and names a new Lead Administrator, with the prior administrator’s recommendations still under Bureau review as of October 14, 2026.