Exploited Router Flaws: A Tracker for Home Network Devices

Most router security advice is general. This page is specific: it lists the flaws in home routers, Wi-Fi gear, cameras and network storage that are confirmed to be used in real attacks, and says what to do about each one. It lists no attack code or instructions, only what you need to find out whether your device is affected.

The short version: 89 home-network flaws are on the US government’s list of exploited vulnerabilities as of 6 November 2026. For 17 of them (19%), the official advice is to stop using the device because it is no longer supported. 24 were added five or more years after the flaw was first numbered, so an old router is still a live target.

---

Find your device

Type your router’s brand or model below. Your model number is usually on a label on the underside of the device. A match doesn’t always mean your exact model and firmware are affected, so open the vendor notice to confirm. No match doesn’t prove your device is safe, because this list only includes flaws confirmed to be in use.

89 entries

Source: CISA Known Exploited Vulnerabilities catalog, version 2026.11.06. “Added” is the date CISA listed the flaw, not the date it was discovered. “Type” and “What to do” are our plain-English summaries of CISA’s entries.

---

What the list shows

• 59 entries are routers and Wi-Fi equipment, 17 network storage and 13 cameras or video recorders.
• 13 are marked by CISA as used in ransomware campaigns.
• 9 were added in the past 12 months.
• 37 are command injection flaws, where a device runs instructions hidden in a web request. It is the most common type here.

Some brands appear more often than others. That mostly reflects how widely their devices are sold and how much attackers look at them, so it isn’t a ranking of which brand is safest.

---

If your device is listed

• Check your exact model and hardware version. A label on the device gives both, and the vendor notice in the table says which ones are affected.
• If a fix exists, install it. Log in to your router and look for a firmware update. Meet Your Router shows how to get to the settings page.
• If the device is out of support, replace it. No update is coming, and settings changes only reduce the risk.
• Turn off remote administration and change the admin password. Many of these attacks arrive over the internet, against a login page that was never meant to be public.
• Check for signs of tampering. Has your router’s DNS been hijacked? shows the most common one.

You can also see what your connection exposes to the internet with the Port Scanner. For a full walk-through, the free Secure Your Home Network course takes seven short lessons.

---

What this tracker can’t tell you

• CISA’s list is a US government catalog of flaws with evidence of real-world use. It doesn’t include every flaw, and it can’t include ones nobody has caught being used.
• Business firewalls, switches and enterprise gateways are left out, so this page stays about equipment found in homes and small offices.
• A listed flaw may need specific firmware or settings to work.
• Vendor links come from CISA’s entries, and older ones can move or disappear. The CVE link goes to the US National Vulnerability Database entry.

Related Reading

• Has Your Router’s DNS Been Hijacked? How to Check
• Lock Your Router’s Front Door
• Smart Devices Without the Risk