We Dug Old Routers Out of Closets and Attics — Running Them on Today's Internet Was a Security Nightmare

There's a router in your neighbor's house right now that hasn't been updated since the Obama administration. Maybe it's in your house. It's probably working fine — lights are on, Netflix is streaming, nobody's complaining. But "working fine" and "actually safe" are two very different things, and we wanted to find out exactly how wide that gap has gotten.

We sourced eight routers manufactured between 2015 and 2019 from real households — not eBay pulls or lab stock, but devices that had been in active daily use. We brought them into our test environment, connected them to a current gigabit ISP service, and ran them through a battery of security checks, performance benchmarks, and compatibility tests. What we found should make anyone still running legacy hardware genuinely uncomfortable.

The Devices We Tested

We're not naming specific models here because this isn't about dunking on particular brands — it's about a category of hardware that has aged out of relevance while still sitting on millions of American countertops. Our eight devices represented a mix of budget and mid-range units from major manufacturers, all of which were considered solid choices when they shipped. Two were ISP-provided gateway units. The rest were consumer purchases.

All eight were running their most recent available firmware at the time of our test. For six of the eight, that "most recent" firmware was between two and five years old. For two of them, the manufacturer had ended support entirely.

The Security Picture: Not Great

Let's start with the finding that kept our team talking for days after we wrapped testing.

Five of the eight routers we tested had known, publicly documented vulnerabilities that have never been patched — not because nobody noticed them, but because the manufacturers stopped issuing updates. These aren't theoretical risks. They're documented CVEs (Common Vulnerabilities and Exposures) sitting in public databases that anyone with a search engine can find.

Three of those five vulnerabilities involve remote code execution — meaning an attacker on your network, or in some cases on the open internet, could potentially run arbitrary commands on your router. In plain English: someone could use your router against you without ever touching it.

The two ISP-provided units in our test had a different problem. Both used outdated WPA2 implementations with known weaknesses in their key exchange protocols. Neither supported WPA3, which has been the industry standard for several years now. If you're still on one of these, your wireless encryption is running on a protocol that security researchers have been poking holes in since 2018.

We also checked for default credential exposure — one of the oldest and dumbest attack vectors in networking. Two of our eight devices shipped with manufacturer default admin passwords that couldn't be changed through the standard UI without a firmware update that no longer exists. Those passwords are, of course, documented in public support forums.

The Performance Penalty Is Real and Measurable

Security aside, we wanted to quantify what legacy hardware actually costs you in speed on a modern gigabit connection.

The short answer: a lot. The longer answer is more nuanced.

On a 1 Gbps symmetrical connection, the best-performing legacy router in our test maxed out at 412 Mbps throughput in ideal conditions — one device, line of sight, no interference. That's less than half your available bandwidth gone before you've even added a second device to the network.

The worst performer? 187 Mbps under the same conditions. That router's processor simply cannot handle the NAT translation and packet inspection required to push gigabit speeds. You're paying for gigabit internet and getting roughly cable-modem-era performance.

When we loaded the network with 15 simultaneous devices — a pretty normal household scenario in 2025 — things got worse. Latency on the older hardware spiked dramatically during peak load. One device averaged 340ms latency with 15 clients active. For context, anything above 100ms starts to feel broken for video calls, and competitive gaming becomes essentially unplayable above 50ms.

Compatibility With Modern ISP Requirements

Several major US ISPs have updated their provisioning requirements over the past few years, including changes to DOCSIS standards, IPv6 handling, and DHCP behavior. Three of our eight routers had measurable compatibility issues that required workarounds — and in one case, the device simply refused to negotiate a proper IPv6 address, falling back to IPv4-only in a way that created subtle but real performance degradation on services that prefer IPv6.

Two of the ISP-provided gateways had been effectively "orphaned" by their respective carriers — still functional on the network, but no longer receiving configuration pushes or remote management updates from the ISP side. The ISPs we spoke with confirmed that devices this old are outside their support window, meaning if something breaks at the provisioning level, you're on your own.

The Part That Surprised Us Most

We expected old hardware to be slow. We expected some security gaps. What we didn't expect was how invisible all of this is to the average user.

Every single one of these routers presented a clean, green status light. Every one connected to the internet without complaint. None of them showed any user-facing indication that they were running unpatched firmware with known exploits, operating at a fraction of available bandwidth, or using encryption standards that security researchers have deprecated.

That's the real problem. These devices don't fail loudly. They just quietly underperform and quietly expose your network, and unless you know to go looking, you'd never know anything was wrong.

When Is Old Too Old?

Our threshold, based on this testing: if your router was manufactured before 2020 and hasn't received a firmware update in the past 18 months, it's time to replace it. Full stop.

If it's an ISP-provided unit from before 2021, call your ISP and ask about a free upgrade — many carriers will swap aging gateway hardware at no charge, and it's worth the 20-minute phone call.

The security risks alone justify the replacement cost. The performance gains are just a bonus.