In July 2026, the NSA, CISA, the FBI, and partner agencies from 12 other countries published an advisory warning that Russia’s FSB Center 16 has been exploiting poorly configured networking equipment across energy, healthcare, financial services, communications, and other sectors.

The advisory includes several hardening measures, and there are five specific fixes that every Cisco router owner should consider implementing immediately.

Turn off management services you’re not using

If you don’t use it, why is it listening?

The advisory’s first recommendation is to use SNMPv3 instead of older SNMP versions that rely on unencrypted community strings. That’s useful advice for organizations managing lots of network equipment, but your home router may not expose SNMP at all.

The broader lesson is to pay attention to what services your router is running. Depending on the model, that could include SNMP, SSH, Telnet, FTP, or USB file sharing, media-server features, or other optional services you’ve enabled over the years. If you actually use one, leave it alone and make sure it’s configured securely. If you switched it on for something you stopped using six months ago, there’s not much reason to keep it running.

I wouldn’t blindly disable settings you don’t recognize on an ISP-supplied router, since providers may use some services for diagnostics, provisioning, or updates. Stick to features you know you enabled yourself and no longer need. It can also be useful to check which ports and services your router is exposing rather than assuming nothing is reachable simply because you haven’t configured it recently.

Kill default and reused passwords on the router itself

admin has had a good run

Strong, unique credentials are another of the NSA’s recommendations, and this one carries over almost unchanged. Router admin passwords are easy to forget about because you may only type yours once every few years. If it’s still admin, something short and predictable, or a password you also use elsewhere, change it.

Your router admin password is separate from your Wi-Fi password. The Wi-Fi password controls who can join the network. The admin password protects the settings that control the network itself, including DNS, firewall rules, port forwarding, and wireless configuration.

A password printed on the router isn’t automatically a problem. Newer routers often ship with a unique generated password. The bigger problem is a shared factory credential, since default router admin passwords can be publicly documented, or anything you’ve reused elsewhere.

I’d use a password manager to generate and store a unique admin password. This takes a couple of minutes and removes one very avoidable weakness.

Disable old setup features once setup is over

WPS can stop living in 2012

The NSA advisory specifically calls out Cisco Smart Install, a zero-touch provisioning feature designed to help organizations configure new networking equipment. Cisco has recommended disabling Smart Install when it isn’t required, and exposed implementations have also been involved in serious security issues, including remotely exploitable vulnerabilities.

Your home router probably doesn’t have anything directly comparable to Cisco Smart Install. WPS is probably the clearest consumer example. It was designed to make connecting devices to Wi-Fi easier, particularly when entering a long wireless password was inconvenient. The problem is that PIN-based WPS can undermine an otherwise strong Wi-Fi password because of its well-documented brute-force weaknesses.

If all of your devices are already connected and you don’t use WPS anymore, leaving it enabled doesn’t buy you much. The same applies to other convenience features you switched on during setup and forgot about. Find out what they do first, then disable the ones you genuinely don’t use.

Keep the admin interface off the public internet

There’s no need to advertise the front door

The advisory also recommends blocking management traffic such as TFTP, Smart Install, and SNMP from reaching network equipment from outside unless there’s a specific reason to allow it.

For a home router, the closest equivalent is WAN-side administration. Look for a setting called Remote Management, Remote Administration, Web Access from WAN, or something similar. It controls whether the router’s settings page can be reached from the internet rather than only from devices connected to your home network.

If you never manage your router while you are away from home, there is little reason to leave that door open. A VPN back into your home network is the safer route when your router supports one, while manufacturer-provided remote access should at least use a strong password and multi-factor authentication whenever it is available.

The point here isn’t how many management features your router is running — it’s who can reach them in the first place.

Actually install firmware updates

At some point, old firmware becomes a liability

The final headline recommendation is the least exciting one: keep network devices patched. Routers need regular firmware updates too, since those updates can fix security vulnerabilities just like updates on your phone or PC. Some routers install them automatically, some make you click an update button, and ISP-supplied models may receive them directly from the provider.

It’s worth checking which camp yours falls into. Open the router’s settings and look for its firmware version, update controls, and automatic-update option. If your router supports automatic firmware updates, enabling them saves you from having to remember this later.

I’d be more concerned if the router has stopped receiving updates altogether. The NSA advisory specifically recommends replacing end-of-life networking equipment with supported hardware. An unsupported router doesn’t become dangerous overnight. The problem is that newly discovered vulnerabilities can pile up after the manufacturer has stopped fixing them.

If yours hasn’t received an update in years, check whether your router has reached end of life. End-of-life status is a much better reason to replace a router than simply wanting whatever Wi-Fi number is newest.

You don’t need to run your house like a data center

The NSA wrote this advisory for organizations running serious networking equipment, not people trying to secure the router behind their TV. The useful habits still carry over.

Use a proper admin password, turn off management and setup features you don’t use, keep the admin interface away from the public internet unless you need it there, and make sure the router is still receiving security updates.

For most home networks, that’s a fairly small amount of work for a device that sits between every gadget you own and the internet.