About the Router Security Scorecard
There are hundreds of “router security tips” pages and they all say the same nine things. This one starts somewhere else: pick your actual model and see the vulnerabilities actually published against that firmware, live from NIST’s National Vulnerability Database. The model list is built from NVD’s own device dictionary, so every entry is a device with real data behind it.
The ranking is the part that matters. A severity score of 9.8 that needs physical access is less urgent on a home gateway than a 7.5 anyone on the internet can reach, so this pulls out the subset that is remotely exploitable with no credentials and no help from you — straight from the CVSS vector — and separately flags anything on CISA’s Known Exploited Vulnerabilities list, meaning attackers have genuinely used it against real devices.
That distinction reverses the obvious reading. One popular Netgear model carries 139 published CVEs and one known-exploited entry; a popular TP-Link model carries six CVEs, two of them known-exploited. The device with twenty-three times the paperwork is in the better practical position, because a CVE count mostly measures how many researchers looked. The hardening checklist below is ordered the same way — by what actually gets exploited, not alphabetically.
Sorted by what an attacker can actually do with them, not by score: known-exploited first, then anything reachable without credentials, then by severity.
Ordered by how often each one is actually exploited rather than alphabetically. Your ticks are saved in this browser.
The question when you are replacing a router. Pick a second device and see both records side by side — and remember that a low count on an obscure model often means nobody looked.
How to Use the Router Security Scorecard
Turn your router over. The model number is on the label, usually printed next to the default Wi-Fi password — something like R7000, Archer C7 or RT-AC68U. Pick the manufacturer, start typing the model, and the tool pulls every vulnerability NIST has published against that firmware. The model list is built from NVD’s own device dictionary rather than a hand-written one, so a device that appears here has real data behind it and one that does not is genuinely unknown to the database.
The Count Is the Least Useful Number
A large CVE total is the first thing people see and almost always the wrong thing to react to. Published vulnerability counts track how much attention a device has received from researchers at least as much as how badly it is built. A flagship model that security teams take apart at conferences accumulates entries; a cheap unbranded box nobody has ever opened accumulates none, and the second is not therefore safer.
Two real examples from the data, both popular models. One well-known Netgear router carries 139 published CVEs, of which 20 are remotely exploitable without credentials and one appears on CISA’s exploited-in-the-wild list. A well-known TP-Link model carries just six CVEs — but two of those six are on the exploited list. On the headline number the Netgear looks twenty-three times worse. On the number that describes what is actually happening to real devices, it is in the better position. That inversion is the whole reason this tool sorts the way it does.
What "Remotely Exploitable Without Credentials" Means
Every CVE carries a CVSS vector describing the conditions an attacker needs. Three of its fields decide whether a flaw is a practical threat to a home router:
- Attack vector: Network. It can be triggered across the internet, rather than needing someone on your Wi-Fi or physically holding the device.
- Privileges required: None. No login. The attacker does not need to have already got in.
- User interaction: None. You do not have to click anything, visit anything, or be at home. It happens whether or not anybody is using the router.
All three together describe a flaw that a script can exercise against every device of that model on the internet, continuously, forever. That is how botnets are assembled, and it is a different category of problem from a vulnerability that requires an authenticated admin session. Sorting by severity score alone mixes the two together, which is why this tool separates them.
CISA’s Known Exploited Vulnerabilities catalogue is a further step up. Entries on it are not theoretical: the US cyber-defence agency has evidence of them being used against real systems, and federal agencies are legally required to remediate them on a deadline. If your model has an entry there, that is the one item on this page worth acting on today.
The Settings, and Why They Are In This Order
Generic checklists present a dozen settings as equally important. They are not, and the ordering here reflects what actually gets exploited.
- Remote administration from the internet. First, and by a distance. Nearly every remotely exploitable router vulnerability needs the management interface reachable from the WAN side. Turn it off and most of the CVE list above becomes unreachable regardless of whether the underlying bug was ever patched. It is the single highest-value setting on any home router.
- Firmware updates. The vulnerabilities listed here are mostly fixed ones. Whether they matter to you depends entirely on which build you are running, and consumer routers overwhelmingly do not update themselves by default.
- The default admin password. The Mirai botnet, which took a large part of the internet offline in 2016, was assembled almost entirely from devices still using factory credentials — a list of about sixty username and password pairs was enough.
- WPS. The eight-digit WPS PIN is validated in two halves, and the last digit is a checksum, so the search space collapses from a hundred million combinations to roughly eleven thousand — a matter of hours. The offline “Pixie Dust” variant is faster still. This has been public since 2011 and the feature is still enabled by default on plenty of hardware.
- UPnP. It lets any device on your network open a port through the firewall to the internet with no authentication and no notification. Convenient for games consoles; equally convenient for anything that has already got a foothold on your network.
- WPA3 over WPA2. WPA3’s handshake removes the offline attack that WPA2-PSK permits, where an attacker captures a few packets and then guesses your passphrase at leisure on their own hardware, with no further contact with your network.
Below those come guest-network separation for IoT devices, DNS rebinding protection, turning off management over plain HTTP, and disabling Telnet. All worth doing; none as consequential as the first three.
What This Tool Cannot Tell You
Two honest limits. First, it does not know which firmware version you are running, so it cannot say whether a given flaw is still open on your device — it tells you what has been found for that model, and updating is what closes the gap. Second, NVD lags and is incomplete: a vulnerability disclosed this week may take days to appear, and vendors frequently patch quietly without any CVE ever being filed. Treat it as the best public record rather than a complete one.
Worth pairing with a look at what the rest of your accounts support — the Two-Factor Auth Coverage Planner covers that — and if something arrived by email that prompted this, the Email Header Analyzer and the Phishing Link Analyzer are the tools for it. Browse every Security & Privacy tool for more.
Frequently Asked Questions
My router has 139 known vulnerabilities. Should I panic?
Almost certainly not, and the raw count is the most misleading number here. A popular model that security researchers actually study accumulates CVEs precisely because people are looking at it, and most of those flaws were fixed years ago in firmware you may already be running. Two numbers matter far more: how many are exploitable remotely without credentials, and how many appear on CISA's Known Exploited Vulnerabilities list. A router with 139 CVEs and none being exploited in the wild is in better shape than one with six CVEs of which two are actively used by attackers — a real comparison between two popular models.
The tool shows no vulnerabilities for my model. Is it secure?
It means NIST has no published CVEs for that firmware, which is not the same thing. Obscure and cheap devices are often the least researched, so an empty result can equally mean nobody has ever looked. Absence of evidence genuinely is not evidence of absence here. If your model returns nothing, treat the hardening checklist as the whole of your answer rather than a supplement to it.
Why does "remotely exploitable without credentials" matter more than the severity score?
Because a router sits on the public internet by definition. A flaw scored 9.8 that requires physical access or an existing admin session is far less urgent on a home gateway than a 7.5 that anyone anywhere can reach with a single request. The distinction comes straight from the CVSS vector — attack vector Network, privileges required None, user interaction None — and this tool separates that subset out rather than sorting by score alone.
What is the single most valuable thing on the checklist?
Turning off remote administration from the internet, and updating the firmware. Almost every remotely exploitable router vulnerability requires the management interface to be reachable from the WAN side; with it off, most of the list becomes unreachable regardless of whether the underlying bug is patched. After that, changing the default admin password — the Mirai botnet was assembled almost entirely from devices still using factory credentials — and disabling WPS, whose PIN is validated in two halves and so falls to roughly eleven thousand guesses rather than a hundred million.
How current is this data?
The vulnerability records come live from NIST's National Vulnerability Database and are cached for a week; the model list is cached for a month. NVD is the authoritative public source, but it does lag: a vulnerability disclosed this week may take days to appear, and vendors sometimes patch quietly without a CVE ever being filed. Use it as the best available public record rather than a complete one.
