D-Link is warning users that six of its VPN router models have at least one major security flaw that it won’t be fixing because the routers are old and at the “end of service life.”
The firm isn’t releasing full details about the vulnerability, likely because there’s no fix and could still be exploited. But it does reiterate the bug report from its finder, who states that it’s a stack overflow vulnerability that could allow unauthorized users to conduct a remote code execution attack. In simple terms, this means it’s a memory issue that could result in a hacker being able to inject malware or other malicious code onto the device.
PCMag-Recommended Routers
D-Link is strongly advising customers with the six older VPN routers listed below to buy the newer one, the D-Link 4-Port Unified Services VPN Router (DSR-250V2), which costs $200. If you have one of the models listed below, you can get 20% off your new purchase (though it’s also 30% off on Amazon for Black Friday).
Four of the impacted VPN routers were first released in 2012, according to their respective Amazon US listing pages. Another one was released in 2011. All of these routers are at least 10 years old (the remaining two appear to be even older). Five of them are still for sale on Amazon for some reason, though, despite no longer being supported. It’s a good idea to check any router’s release date before purchasing it. A few of these old VPN routers even still have lots of positive Amazon reviews.
D-Link says that if you really want to keep your old VPN router, you should make sure it has the last provided firmware update, ensure you update its password frequently, and keep Wi-Fi encryption enabled with a different password. But do so at your own risk.
Recommended by Our Editors
These are the router models impacted by the security flaw:
-
DSR-150 (D-Link support ended May 1, 2024)
-
DSR-150N (D-Link support ended May 1, 2024)
-
DSR-250 (D-Link support ended May 1, 2024)
-
DSR-250N (D-Link support ended May 1, 2024)
-
DSR-500N (D-Link support ended Sept. 30, 2015)
-
DSR-1000N (D-Link support ended Sept. 30, 2015)
These days, a VPN app is probably enough for most users. A VPN router will protect all of your devices at once, however, and can give you 24/7 protection at a potentially lower cost.
Do You Need a VPN?
Like What You’re Reading?
Sign up for SecurityWatch newsletter for our top privacy and security stories delivered right to your inbox.
This newsletter may contain advertising, deals, or affiliate links. Subscribing to a newsletter indicates your consent to our Terms of Use and Privacy Policy. You may unsubscribe from the newsletters at any time.
About Kate Irwin
Reporter
