0

Recently I realised that my new router's firmware was outdated.

Searching a bit, I found out that most routers need to be manually updated to a new version of firmware. Running an old firmware could potentially mean unpatched bugs that could harm the network.

So why isn't there a form of automatic update or at least a notification system (email lists from the router companies or an app that communicates with the router perhaps to check its firmware version) to warn about a possible new firmware that could secure our network?

|improve this question
  • 1
    Welcome to NE! We hope you will become a contributing member of this community. Sadly, questions that lead primarily to opinions are off-topic here. – Ron Trunk Sep 4 '18 at 13:49
  • Sorry I didn't know a priori that it was an "opinion answered question". Should I delete it? – Jack D. Sep 4 '18 at 14:02
  • You question is also about consumer-grade devices, which are explicitly off-topic here. – Ron Maupin♦ Sep 4 '18 at 17:20
  • 1
    Waiting for the consumer to break ("update") their gear is the lesser evil. Go ask AT&T Uverse users how much fun it is to randomly have their hardware "upgraded" -- about half the time it breaks things, requiring a complete erase-and-reconfigure. – Ricky Beam Sep 4 '18 at 17:57
4

I feel it's less about security reasons than it is about avoiding downtime and causing outages, especially in the case of not using dynamic routing to re-route traffic in the downtime or in the case of not using high-availability such as HSRP or VRRP. It's also due to a lot of us practicing the belief that if it's not broken, don't fix it, on top of if there are no new features you need in the upgrade and the bugfixes it provides are for features you don't use, there is no real benefit. In addition to this, many organizations (mine included) are contractually required to submit to n-1 and change control, meaning that at specified times per year non-production devices are upgraded to the n-1 release for their model and if deemed to be stable after x amount of time, production devices are upgraded to the same release. If devices were automatically upgraded it would potentially mean that we would always be running "n" (THE most current release), risking that we may be running a beta or even alpha, putting the stability of the environment in jeopardy, and being in violation of proper change control.

My final reason to avoid this is that with some new releases, even if they're just a minor release (for example ASAs migrating from 8.2 to 8.3) there was an entirely new configuration syntax and logic, specifically as pertains to NAT and ACLs, that have a high risk of breaking environments if not converted properly. If the devices were done in the middle of the night without an admin being involved, it could be disasterous until the admin finds what broke and repairs it.

|improve this answer
  • First of all I understand and agree with you with the potential risks from always running the latest releases (e.g. beta or alpha). I also find the second reason you gave concerning the possible change in configuration syntax very logical. But in my question that is why I clarified that I am mainly referring to house routers or routers at a coffee shop for example. Most people there might have the same router firmware for many years. Bugs are found on these commercial routers very often and if they are hit by malware it is a serious risk (example public WiFi). – Jack D. Sep 4 '18 at 13:40
  • Also in the cases I listed above it is much easier to find a time in the day (night) to minimize the problems due to downtime. Which will not be very often since we are not talking about monthly updates but more serious ones. – Jack D. Sep 4 '18 at 13:42
  • 3
    The only real way to get an answer is to ask the manufacturers. Everything else is just speculation. – Ron Trunk Sep 4 '18 at 13:50
  • 2
    There are lots of reasons you don't want equipment changing itself: who is responsible when it stops working like it used to? What new bugs are introduced? What new interoperability issues arise? – jonathanjo Sep 4 '18 at 13:51
  • First, home networking equipment is off limits here, so we'll have to exclude that. Second, yes, some routers run the same firmware/software for years without patching but, again, if the fixes in the newer versions are for things you don't even use, or have disabled, it's not really fixing anything. For example, it only has a security fix for SNMP but you don't even use SNMP and have it disabled. The fix is effectively useless and an upgrade not warranted. Yes, you could upgrade anyway but, for what purpose? What's being gained other than risk? – Jesse P. Sep 4 '18 at 13:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.