That's very interesting and thank you for the explanation. I didn't realize that security was that important and that routers that don't get firmware updates are basically a disaster waiting to happen.
I also used to believe that stick with the manufacturer official firmware rather than getting a third party one because, you know manufacturers knows what's best... At least when it comes to security etc and this belief originated from when I used to flash custom software on my phone's etc a long time ago..
I've never flashed custom firmware on a router, and was worried a little that I might break it
Just to give you an idea, the link below is for security issues related to Broadcom based products. They obviously don't just make router chips, but last year there were 39 vulnerabilities and so far this year 24, with a handful or more of those being bad to severe. Obviously some of the code from Broadcom is in Broadcom based routers and those are issues that requires multiple steps to fix the problem from the router makers side.
Broadcom products and CVEs, security vulnerabilities, affecting the products with detailed CVSS, EPSS score information and exploits
www.cvedetails.com
This doesn't take any of the third party software that is running on a router into account.
Looking at the RT-AC86U for example, the second to latest firmware lists:
1. Fixed CVE-2021-3450, CVE2021-3449 OpenSSL related vulnerability.
2. Fixed authentication bypass vulnerability. Special thank Chris Bellows, Darren Kemp – Atredis Partners contribution.
3. Fixed PPTP and OpenVPN server username/password GUI bug.
4. Fixed high CPU utilization issue.
5. Fixed the fragattacks vulnerability.
That's at least half a dozen of issues that someone could potentially use to try and gain access to the router.
Obviously, not all CVE vulnerabilities are critical, but almost every firmware update from Asus contains a handful of fixed issues.
Merlin works reasonably closely with Asus, or at least used to, haven't really kept on top of things, but it's the same user experience, just with more features and usually more up to date security fixes. Voxel is the same for Netgear routers, although he doesn't support as many models.
OpenWRT and DD-WRT are different beasts entirely and I have two TP-Link devices in my home that I loaded OpenWRT on, because TP-Link released exactly three firmwares for each device and then moved on to a new hardware revision. It's not as user friendly as most default OSes on these devices, but sometimes it's better than the native firmware. DD-WRT is a bit nicer to use than OpenWRT imho, but the hardware support varies between the two. It generally won't break anything, but you might lose control over options like being able to turn off LEDs etc.
I think your current router should have better support for DD-WRT than OpenWRT, as it was something Linksys was touting when they launched it.
Keep in mind that big companies like Cisco is just as affected by these security issues as anyone else in the business, so I'm not pointing fingers at Asus or Broadcom here, it's just a fact of how things are, since software has bugs and these bugs are being exploited by some people.
But the best thing you can do to protect yourself, is to keep your router up to date. I'm not even worried about things like someone putting some kind of tool that can log credit card transactions on my router, but rather that it ends up as part of some botnet or something similar, as that's just as bad and much more likely.
I honestly wish there was more enforcement on router makers being liable for firmware updates for at least five years, at a minimum level to make sure they fix any kind of exploitable security issues, but alas, that is not the case. Asus and D-Link did actually get a slap by the FCC a few years ago and this is why Asus routers that are sold in the US tend to get pretty regular software updates, unlike some of their other models that are supported just as well as my TP-Link products... As such, check what you're buying, so you don't get a dud.
