As cyber threats become more sophisticated, attackers are no longer just looking for obscure vulnerabilities, they are exploiting what is right in front of them. One of the most overlooked yet serious risks in any organisation is the continued use of End of Life (EOL) or unpatched devices.
These devices may still be running in your environment, but without updates or vendor support, they no longer provide the protection needed to keep your systems secure.
What does End of Life actually mean?
A device or application is considered End of Life (EOL) when the manufacturer stops providing:
- Security updates
- Bug fixes
- Technical support
- Hardware replacement or warranty coverage
From that point forward, the device becomes a static target. It remains visible to attackers but can no longer be secured with patches or upgrades. In other words, it’s an open invitation for cybercriminals.
Why attackers target EOL and unpatched devices
- No more security patches
Once a device reaches its end of life, it stops receiving updates, including critical security patches. That means any new vulnerabilities discovered after the device is retired will remain unpatched, leaving a permanent gap in your defences. Attackers know this and actively scan for these known flaws, using them to gain unauthorised access or deploy malware with little resistance. - Publicly available exploits
Vulnerabilities in older devices are often well documented in public databases. Cybercriminals do not need advanced skills to exploit them. Off the shelf exploit kits and prewritten scripts are widely available on the dark web and in hacking forums. This makes older devices low effort, high reward targets for attackers of all skill levels. - Compliance violations
Using outdated and unsupported devices can breach regulatory requirements under frameworks like the Essential Eight and the Privacy Act. Failure to meet these obligations not only increases security risk but could also result in financial penalties, failed audits, or reputational damage, especially in industries where data protection is mandated - Unsecured configuration defaults
Many older devices are still using default configurations that were never hardened against modern threats. This includes factory set usernames and passwords, outdated encryption protocols, and enabled remote access features. These defaults are widely known and easily abused by attackers to gain control of a device, often without triggering alarms.
Case study: FBI & DrayTek Warnings, EOL Routers Exploited
In May 2025, the FBI issued a public warning about attackers exploiting End of Life routers from Cisco and Linksys. Using a malware strain known as TheMoon, attackers turned outdated routers into proxy nodes for criminal activity.
Affected Models Included:
- Linksys E1200, E2500, E3200.
- Cisco Linksys E1000, E1500, E1550, E4200, WRT610N.
- Cradlepoint E300, E100.
- Cisco M10.
- Linksys WRT320N, WRT310N.
This sophisticated malware doesn’t require a password to infect vulnerable routers. Instead, it scans for open ports, injects malicious commands, and connects back to attacker controlled command and control servers. Once compromised, these devices can be remotely controlled, used to mask criminal activity, or added to larger botnet networks, all without the user’s knowledge.
But this isn’t an isolated case.
In recent years, older DrayTek routers have also been flagged for critical vulnerabilities, with some linked to malicious activity originating from China. These routers were targeted due to:
- Outdated firmware
- Default admin credentials
- Open WAN ports left exposed
Security researchers identified remote code execution (RCE) vulnerabilities that could allow attackers to take full control of the device, often without triggering alerts. These older DrayTek models, common across many small businesses, remain a high risk if left unpatched or unsupported.
Read more from CyberDaily: Active exploitation of DrayTek router vulnerabilities
How your organisation can defend against these attacks
- Audit your network
Conduct a full asset inventory. Identify any outdated or unsupported routers, firewalls, switches, or servers. - Replace EOL hardware
Upgrade to modern, supported devices with ongoing patch and warranty coverage. - Harden device configurations
Ensure factory settings (default passwords, remote access, etc.) have been changed or disabled. - Monitor everything
Use endpoint monitoring and vulnerability scanning tools that detect outdated firmware and missing patches. - Stay compliant
Align your IT security practices with frameworks like the ACSC Essential Eight, a set of practical strategies recommended by the Australian Cyber Security Centre to help organisations prevent and recover from cyber attacks.
Final thoughts
End of Life devices are not just outdated, they are unpatched, unmonitored, and unsecured. They create simple access points for attackers and put your business at risk. Replacing or securing these systems is a necessary part of maintaining strong cybersecurity.
Chill IT provides expert audits to help identify outdated and high risk devices. We’ll guide you through secure upgrade options and help ensure your business remains aligned with best practice cybersecurity frameworks.
Fill in the form below and one of our specialists will be in touch.
