Check your router, then act with confidence

Vulnerable TP-Link and MikroTik routers

DNS hijacking used to redirect traffic and harvest credentials.

Update supported firmware, replace end-of-life hardware, and check DNS and admin settings.

SOHO routers and smart devices

Compromised edge devices used to hide attacks against critical sectors.

Patch, disable unnecessary remote management, and use strong unique admin credentials.

ASUS consumer routers

Known vulnerabilities plus weak credentials were combined to add persistent SSH access that survives reboots.

Install the latest ASUS firmware, inspect for unknown SSH keys or access, and replace unsupported models.

TP-Link routers and smart devices

Older unsupported routers have appeared in botnets and credential attacks.

Check your hardware version, apply the official patch, and retire end-of-life units.

Legacy D-Link routers

Legacy models actively targeted through old vulnerabilities and recruited into botnets.

Replace affected end-of-life models rather than relying on a reboot.

DrayTek Vigor routers, access points and switches

Code execution, information disclosure, denial of service, buffer overflow and WLAN-driver issues.

Match the exact model to its advisory and use official firmware only.

Older EE, Sky, TalkTalk, Virgin Media and Vodafone routers

A Which? investigation reported weaknesses in several old ISP-supplied models.

Ask whether your exact model still receives updates and request replacement if it does not.

Sky Hub 3 or earlier and selected NOW hubs

Reports described provider notices that some older hubs would no longer receive security updates.

Confirm the exact model and notice, change the admin password, and replace unsupported equipment.