Asus rt-ac56u: Last Merlin firmware 2 years ago, time to replace?

[pattox]

I have one of the wireless routers which does everything I need and is working perfectly. My concern is that the latest and last merlin firmware is around 2 years old.

I am wondering whether there may have been security threats over the period since the last update, and if so should I consider replacing this router with another more recent one which still receives current firmware updates.

And, if I were to replace it, what woudl be a good replacement.

 

[barutchiev]

Why don't you use john's fork. If this router does everything you need, this fork will provide you with security.

 

[grifo]

Why don't you use john's fork. If this router does everything you need, this fork will provide you with security.

Good advice. I wish John's fork supported my RT-AC87U which is also no longer supported by Merlin firmware.

 

[pattox]

Thank you both. I will follow through with your suggestion.

I’m just wondering what specific security vulnerabilities may now exist and how serious they may be.

 

[grifo]

John's fork provides maintenance for documented security issues so security vulnerabilities are being taken care of. The last update was on 12-July-2020.

Additional Information
The fork does include

Maintenance for documented security issues
Maintenance for supporting open source components (such as OpenSSL, Openvpn, dnsmasq, miniupnpd, etc)
Backports of applicable fixes and new functions from Merlin's main branch
...

Whereas if your router's last Merlin firmware update was 2 years ago it's several security fixes behind. Have a look at John's fork changelog to see what has been fixed since.

 

[Bob.Dig]

Asus last Update was from November last year, which isn't bad. But sure, go with John's fork.

 

[pattox]

Have now reflashed with John’s fork. The recommendation in the flashing instructions is to reset to factory settings. I’m holding off doing so because I want to keep my existing settings if at all possible. So far everything seems to be working well. To reconfigure manually would be a real pain.

I’m just wondering what negative consequences or problems may arise if I skip the factory reset altogether.

 

[Deleted member 22229]

It is recommended to reset. That said if your network is up and running the way it should be then roll with it. If you start noticing strange things down the road then you know what must be done.