Question:

Every consumer router-wirelessAP I've seen runs linux.

I never see security upgrades for the kernels they use. Not one. Not ever.

Is this something that should be a cause for concern? Even if you don't run a consumer-grade tplink, netgear, asus, whatever router yourself.

Update: The context which I should have said is that I think LLMs are giving script kids nation state level tools and expertise. This known bug is always less interesting than the next twenty.

Is it a cause of concern? Yes. Will you get hacked? Most likely not.

Most consumer routers run ancient stacks with all kinds of weird proprietary vendor patches that are tied to a specific kernel version. Looking at you Qualcomm!

However they generally also drop all traffic by default so from the WAN side they look like a black hole. I guess that's "safe" enough for most consumers.

For fun, take a look at the open PRs in the OpenWRT repos. Those people are doing some amazing work but it's also frustrating to see them struggle with things that _could_ be easy if the vendor made some slightly better choices.

I would strongly prefer something like OpenWRT though. Call me paranoid but after the last few weeks I'm increasingly less comfortable with connecting my devices to a blackbox.

Mosty probably: not. Traffic passes throught the ASIC, usually it is not processed on CPU or custom code. Unlike typical web servers, that reduces the attack surface as there aren't software parsers (a common place where vulnerabilities hide). Additionally the OS may have additional protection measures, such as signing each binary, signing the booting image and limiting which syscalls can be done by any binary.

This is one of the biggest benefits of using OpenWRT. They update the entire stack like every other month or so you’re never on an ancient kernel or utils.

Ubiquity routers and APs do. Also schedulable backups.

Granted they are pro-sumer devices, not strictly consumer.

Google Wifi used to be good about that. I even got a notification for when my AP was being EOL'd and would no longer receive automatic firmware updates. I don't know if Google is still on the ball there. The Nest acquisition was confusing. Have the Google Wifi and Nest Wifi teams been merged?

But FWIW I run my AP in bridge mode. Wifi drivers and chip firmware seem to be riddled with exploits. I don't want my router & firewall on the same system as the AP.

This is why I use a fanless PC as my internal router. I have complete control and get timely kernel updates from a responsible distro.

even more concerning would be the ones who run closed source os but never update.

at least with an open source os there are more paths forward.

A lot of them run BSD, not linux, which wasn't affected

Nah I wouldn't worry about I'm sure they're fine

eero updates its APs OTA, they run linux. Even stuff sold > 5 years ago is still receiving updates.

full disclosure: they're my employer

Same for Flock cameras, running a 2017 kernel.

most of the routers are patched by ISPs directly. also: they are usually not x86 architecture - so not all exploits are possible.

[dead]