Most small offices have a router tucked on a shelf or in a closet. Someone set it up years ago, it blinks quietly, and nobody thinks about it again. Yet every email, card payment, phone call and file upload passes through that box. If it is out of date or poorly configured, an attacker can watch, redirect or borrow your traffic without touching a single computer.
Routers have been in the news a lot this month. New security flaws were published for widely used models, several states filed lawsuits over router security claims, and federal agencies have repeated their advice to replace old equipment. None of this is a reason to panic. It is a good reason to spend an hour checking the device your whole business depends on.
What happened in the past few weeks
- New flaws in internet-provider routers. On October 8, 2026, the research firm SEC Consult published details of five vulnerabilities (security weaknesses) in TP-Link routers that internet service providers hand out to customers. According to The Hacker News, TP-Link lists 65 affected models, the most serious flaws can let someone take admin actions without logging in or recover stored passwords, and most fixed firmware (the software built into the router) was released by February 2026. No attacks using these flaws had been reported.
- Critical fixes for ASUS routers. SecurityOnline reported on October 7 that ASUS fixed four firmware flaws, two of them rated critical. Exploiting them requires either a logged-in user or an attacker already nearby on the network, and no exploitation had been confirmed. The advice is simple: install the latest firmware and reboot.
- More state lawsuits. Florida, Iowa, Montana and Nebraska sued TP-Link Systems on October 6, joining Texas, which sued in February. The states allege the company misled buyers about router security and its ties to China. TP-Link denies the claims and says it will fight them in court, as The Hacker News reported.
The same report notes that the Federal Communications Commission has blocked new foreign-made consumer routers from U.S. approval since March 2026, but that routers already in use can keep receiving security updates until at least March 1, 2027. In other words, the router you already own is not suddenly illegal, but you do need to keep it patched.
Why an old router is a real risk
This is not only about one brand. In April 2026, the FBI announced it had disrupted a network of small-office and home routers that Russian military intelligence had taken over. As FOX 9 reported, the attackers changed the routers' DNS settings. DNS is the internet's address book: it turns a name like your bank's website into the numeric address your computer connects to. Change it, and an attacker can quietly send your staff to look-alike sites. The FBI said owners in at least 23 states had affected routers.
One point from that warning is easy to miss: the FBI noted that simply restarting the router does not fix this kind of compromise. A router like this has to be updated, reconfigured or replaced, and because the problem lives in the router rather than on any one computer, it can be easy to overlook.
Step 1: Know exactly what you have
Walk the office and list every networking device: the router or modem from your internet provider, any router your business bought, firewalls, Wi-Fi access points and mesh units. For each one, note the brand, the model number from the label underneath, and who manages it (you, your IT provider or the internet provider).
Many offices are surprised to find two routers stacked on top of each other, or an old Wi-Fi unit someone added years ago for the back room. Each one is a door into the network and needs the same care.
Step 2: Update the firmware, or replace the device
- Check for updates. Log in to each device's admin page or app and look for a firmware update. Many newer models can update themselves automatically; turn that on if it is available.
- Ask your internet provider. If the router came from your provider, updates may only come through them. The Hacker News notes that for the affected TP-Link provider models, owners should contact their provider if no update appears.
- Retire end-of-life equipment. When a manufacturer stops supporting a model, it stops receiving security fixes. The FBI recommends replacing end-of-life and end-of-support routers. Look up your model on the manufacturer's website; if it is on an end-of-life list, plan its replacement now.
Step 3: Lock down the settings
- Change default passwords. Both the admin login and the Wi-Fi password should be long and unique, not what was printed on the sticker.
- Turn off remote management. The FBI advises disabling admin access from the internet. If your IT provider needs remote access, they should use a secure method rather than an open admin page.
- Check the DNS settings. Make sure the DNS servers listed are ones you or your provider chose on purpose. Unknown entries are a red flag.
- Review the firewall. Close any port forwarding rules (openings that let outside traffic reach a device inside) that nobody can explain.
- Be careful with extra features. SecurityOnline's ASUS guidance suggests avoiding untrusted links to the router admin page and not restoring configuration backups from unknown sources.
Step 4: Separate your Wi-Fi networks
Customers, patients and visitors should never share the same network as your office computers, card terminals or file server. Set up a separate guest Wi-Fi network, and consider a third network for devices such as smart TVs, cameras and thermostats. If one of those devices is compromised, it cannot easily reach your business systems.
This matters most in places with heavy visitor traffic, such as medical and dental waiting rooms, hotel lobbies, retail stores and assisted living common areas.
Step 5: Put someone in charge of it
The biggest risk with routers is not a single flaw. It is that nobody owns them. Pick a person or an IT provider who is responsible for checking for updates every month, reviewing settings a few times a year, and keeping the equipment list current. Watch for warning signs too: browser certificate warnings, which the FBI flags as a possible sign of tampering, unexplained slowdowns, or settings you did not change.
How Rise Technologies can help
Rise Technologies is a New York-based IT consulting and support company that has served businesses across New York, Long Island and the Tri-State area for over 10 years. Our certified engineers design and install business wireless networks and cabling, including separate guest and staff Wi-Fi. Through our security management services, we handle firewalls, patch management and monitoring so updates do not slip through the cracks. Not sure what is on your network today? An IT assessment will give you a clear inventory and a list of what to fix first.
If you would like a second pair of eyes on your office router and Wi-Fi, call us at (516) 545-0065 or request a free quote. We can work on-site or remotely, whichever suits you.
