USENIX Study Finds 155 New Router Vulnerabilities in Netgear, Linksys Devices

A new USENIX study has cataloged 155 previously unknown security vulnerabilities across 17 networking devices, including routers and access hardware from brands such as Netgear, Linksys, D-Link, and TP-Link. The research, built around automated verification of static analysis results, also highlights a familiar problem for players and home network users: even when fixes exist, whether they actually reached your specific hardware revision and firmware version is often unclear—especially once a product hits end-of-service.

How the research found 155 “unknown” flaws—and what that means

The paper behind the report documents static-tinting results that were then checked automatically by a system called Bond. Researchers fed the tool 2,776 warnings produced by four separate analysis utilities. Of those, 1,349 were confirmed as real security issues. Within that set, the study counts 155 vulnerabilities that were still unknown at the time of discovery; for 108 of them, CVE or PSV identifiers had already been assigned by the study’s reporting window.

Risk severity was not uniform. The researchers broke the issues into categories, including 120 buffer-overflow weaknesses and 35 command-injection weaknesses. Three of the documented flaws were categorized as critical, with the authors stating they could allow remote code execution without prior authentication—potentially enabling full takeover of the affected device. Another 68 issues were rated “High,” while 37 were assessed as “Medium.”

• Bond cross-checked 2,776 static-analysis warnings from four tools
• 1,349 warnings were confirmed as real vulnerabilities
• 155 were previously unknown at discovery; 108 had CVE/PSV IDs by reporting
• Critical items target remote code execution without authentication

Which devices were affected, and where the dataset and patch reality diverge

The study examined devices from Netgear, Linksys, D-Link, Totolink, Tenda, TP-Link, Belkin, and Motorola. Importantly, the authors tested 19 devices overall, but new vulnerabilities were not found in every one of them—hence the difference between 19 tested units and the 155 flaws concentrated across 17 models.

Some models drew particularly heavy attention. The Linksys RE6500 recorded 39 of the newly discovered vulnerabilities. D-Link’s DIR619L followed with 25, and Netgear’s WNDR4500 had 16. Belkin’s F9K1122 had 14, Tenda’s O3V2 recorded 12, and Totolink’s A3002R documented 11.

However, the paper also shows why simply “checking a brand’s support page” isn’t always enough. Netgear’s EX6120 and D-Link’s DNS-320L appeared in the test dataset, yet they did not show up in the table of newly discovered vulnerabilities. That means the presence of a device in the test set does not automatically translate to being impacted by the newly cataloged 155 flaws.

Firmware and support status: why hardware revision matters as much as the model name

The researchers noted that firmware states used in the paper are documented as part of the research artifact. For several Netgear models—specifically R8500, R7000P, XR300, and D6400—the public Netgear support pages still list the same version numbers that appear in the Bond dataset. At the same time, Netgear has labeled R8500 and R7000P as end-of-service products.

One example illustrates the nuance: for the Netgear EX6120, Bond’s tested firmware was 1.0.0.70, but Netgear provided firmware 1.0.0.72 in January 2026, which is newer than the version studied. Still, the authors warn that this alone cannot prove that the specific Bond-discovered issues are already fixed in the newer build. The paper emphasizes that the Netgear and Linksys vulnerabilities referenced were only assigned CVE labels after confirmation and patching—yet it does not consistently map each correction to a particular public firmware build for every individual finding.

TP-Link: the clearest “hardware version + firmware” link

TP-Link offers one of the more traceable cases in the report. For the TL-WR841N, Bond analyzed hardware version V11 using firmware 160325 and found nine new buffer-overflow vulnerabilities. TP-Link’s own disclosures explicitly list firmware up to and including 160325 as affected for CVE-2025-53711 and CVE-2025-53715. Yet the German support page for that hardware revision now shows a newer firmware: 211209.

Linksys: patched claims, but the public version list doesn’t move

For the Linksys RE6500, the paper records 39 newly discovered vulnerabilities and references firmware 1.0.013.001 as the tested state. At the same time, the authors state that Linksys confirmed and patched reported issues. But an updated Linksys page still lists firmware 1.0.013.001 for the RE6500. The NVD also flags that same firmware version as affected in connection with at least one CVE referenced in the study’s discussion.

Support status adds another layer. The report says European variants of the RE6500 reached support end as early as late 2023 (or, at latest, March 2026). Under Linksys’ lifecycle policy, the company does not provide security updates after that point—meaning even “patched” claims may not translate into ongoing protection for older models still sitting in homes.

D-Link and product end-of-life: fewer promises, clearer EOL guidance

D-Link’s situation is described as more straightforward. The researchers say the manufacturer confirmed the vulnerabilities but did not announce patches because the devices had already hit product life end. The paper aligns with what D-Link’s public pages indicate: for models such as the DIR-816, D-Link labels hardware and firmware combinations as EOL/EOS and recommends upgrading to a newer device. Support for the DNS-320L and DCS-932L is described as ended “for years.”

For DNS-320L, a firmware 1.11b01 is still available publicly, which matches essentially the same state used in the Bond dataset. Yet the study reports that Bond did not find any of the newly discovered 155 vulnerabilities on the DNS-320L. For the DCS-932L, the public firmware version 2.18b01 corresponds closely to the tested state, and Bond did document at least one new command-injection vulnerability there.

Belkin: same firmware as the “new flaws” test state and no actionable disclosure response

Belkin’s F9K1122 again shows how version matching can matter. Bond found 14 new vulnerabilities on hardware version 1 using firmware 1.00.33. The paper states Belkin continued offering firmware 1.00.33 and reports that, within its 90-day disclosure window, the company did not provide a usable response. The report also notes that no publicly visible new firmware state is apparent on the support page, though it does not claim that other fixes could not have happened through other means.

Why this matters to gamers and home networks right now

Routers and network devices are part of the same infrastructure that carries matchmaking traffic, game downloads, voice chat, and security-sensitive services like account logins. The study’s headline—155 previously unknown vulnerabilities—matters less as a theoretical risk and more as a practical one: the researchers’ work repeatedly shows that the real-world exposure depends on the exact hardware revision, the installed firmware version, and whether the vendor still provides security updates.

Even in cases where newer firmware exists, the paper stresses that it does not always provide a one-to-one mapping from each vulnerability to a particular fixed public build. Meanwhile, for end-of-service devices, the likely outcome is less about “waiting for a patch” and more about replacing aging hardware—especially for models where the study documents critical issues capable of remote code execution without authentication.