GT-AX6000 lack of firmware updates

[L&LD]

Six months with no updates is not a secure router.

Unless you know otherwise (specifics), Asus' track record has been pretty good on that front for over a decade now.

Also, post 7.

 

[TheLostSwede]

Frequent updates don't guarantee security. Asus had firewall broken on one of the updates exposing devices on Internet in specific configuration. It was like that for >1 month and discovered by accident. Then Asus ASD update killed perhaps millions of routers, recovery by factory reset only and on some models with extra efforts. Then TrendMicro crashes after an update, still ongoing issue. Quality over quantity is more important. Asuswrt features are still broken after years of development, but used actively for advertising purposes.

Sure, but getting security patches every three months or so is what I would expect on a US$300-ish class router. I know nothing is truly secure if it's connected to the internet. I'm not using the TrendMicro stuff.

 

[Tech9]

I replaced one UniFi system for this reason. They have endless updates and always patch something, but it become a habit to check what's broken first before updating. Asus routers situation is very similar. They fix one thing and break something else quite often. Folks around ask questions in release threads if it's safe to update. In a home setup may not be critical, but mine was in a business place with multiple clients and downtime was not an option. Too frequent updates is not a good thing from experience.

 

[Piotrek]

every three months

This is definitely too often. You are using very dangerous devices.
I expect security patches approximately every 1-2 years.

getting security patches

Can you point out any security bugs in ASUS routers that are still available (can be used to hack the router)?

 

[Tech9]

Can you point out any security bugs in ASUS routers that are still available (can be used to hack the router)?

I only remember Asus hacking their own routers with background updates in the last year or so. They did it twice successfully.

 

[Piotrek]

I only remember Asus hacking their own routers with background updates in the last year or so. They did it twice successfully.

Yes, I remember. However, this is not a current security bug.
I'm asking about errors that require repair, which could cause someone (hacker) to hack into the router.

 

[Tech9]

I'm asking about errors that require repair, which could cause someone (hacker) to hack into the router.

Interesting question. Why would @TheLostSwede want an Asus router if he knows about existing security holes on it?

 

[sfx2000]

Interesting question. Why would @TheLostSwede want an Asus router if he knows about existing security holes on it?

It does beg the question - I'm wondering if it's just testing...

I've got a couple of Asus devices just for that task...

 

[Tech9]

That said, only the RT-AX88U Pro has been updated to Asuswrt 5.0

You perhaps already know, but this RT-AX88U Pro is the same hardware as GT-AX6000. The non-ROG version.

 

[TheLostSwede]

This is definitely too often. You are using very dangerous devices.
I expect security patches approximately every 1-2 years.

Can you point out any security bugs in ASUS routers that are still available (can be used to hack the router)?

Well, that is your opinion, I don't agree. We get monthly updates for our phones, so quarterly for a router isn't too often.

 

[TheLostSwede]

Interesting question. Why would @TheLostSwede want an Asus router if he knows about existing security holes on it?

I just assume routers are insecure, just like every other device we connect to the internet and that's why I use devices that get regular security updates.

 

[TheLostSwede]

You perhaps already know, but this RT-AX88U Pro is the same hardware as GT-AX6000. The non-ROG version.

Hence why I mentioned it. The issue locally here is that it would've costed me 70% more than the ugly ROG version.

 

[ColinTaylor]

We get monthly updates for our phones, so quarterly for a router isn't too often.

Monthly! I've never had a phone that had monthly firmware updates. I use mostly Samsung Galaxy phones and see two or three updates a year, if I'm lucky. Less than that if it's more than a couple of years old.

 

[RMerlin]

Monthly! I've never had a phone that had monthly firmware updates. I use mostly Samsung Galaxy phones and see two or three updates a year, if I'm lucky. Less than that if it's more than a couple of years old.

All Pixels receive monthly updates. Current Samsung phones also get monthly updates (because they include Google's monthly Android updates), while their tablets and their older phones will get them quarterly.

Samsung Mobile Security

security.samsungmobile.com

And a lot of Android components are now automatically updated through Play Store, so they no longer require a whole Android update to include those security fixes. So critical components like Webview can be updated on a more frequent basis if necessary if new security issues within that particular component are found.

 

[thecheapseats]

Monthly! I've never had a phone that had monthly firmware updates. I use mostly Samsung Galaxy phones and see two or three updates a year, if I'm lucky. Less than that if it's more than a couple of years old.

android phones direct from goog-source (pixel) do monthly update releases (there may be others - samsung isn't one of them)... as I understand it, third party android licensees need time to qualify those updates they receive for their hardware from the goog-source...

 

[thecheapseats]

All Pixels receive monthly updates....

yep on the pixels... hmm... samsung too? - they must have chaged their update/security dist policy since I stopped using their phones a few years ago...

 

[thecheapseats]

Interesting question. Why would @TheLostSwede want an Asus router if he knows about existing security holes on it?

perhaps because enterprise gear (for the home) that stays very current with fixes are nutty money?... maybe?...

 

[ColinTaylor]

Current Samsung phones also get monthly updates (because they include Google's monthly Android updates), while their tablets and their older phones will get them quarterly.

"on selected Samsung devices" My current phone (which is quite new) is only down for quarterly updates. My slightly older phones aren't on the list at all. Samsung's monthly updates seem reserved for their premium models, which I never buy. So pay more and get security, pay less and you're on your own? So much for "we take security and privacy issues very seriously".

 

[RMerlin]

"on selected Samsung devices" My current phone (which is quite new) is only down for quarterly updates.

Still, that`s on top of the more frequent component updates done through Google Play. Android is no longer the monolithic entity it was years ago, Google has been actively splitting components to make them separately upgradable through Google Play.

 

[Tech9]

perhaps because enterprise gear

What enterprise gear?