Buying Used or Refurbished Routers: Safe or Risky?

Real Security Risks

Malicious Firmware

This is the most serious concern. One of the main risks when acquiring a used router is that the previous owner could replace the default firmware with a possible malicious version. This would allow a hacker to intercept your network traffic, steal passwords, insert malware, and redirect traffic to malicious websites.

While this requires technical sophistication and isn't common for random secondhand sales, it's a real possibility—especially for business routers or high-end models that might be attractive targets.

Compromised Configuration and Leftover Data

Research by ESET found that of 18 secondhand routers purchased, half had been left exactly as when in use. Only five were fully scrubbed of information about the network, credentials, and even physical building security details.

Previous owners' WiFi passwords, network names, connected device information, and sometimes even VPN credentials can remain on routers that weren't properly reset. This creates privacy concerns and potential security vulnerabilities.

Outdated Security Standards

An old, outdated router with obsolete security standards can expose your network to vulnerabilities. If you buy a used router that's 4-5 years old, it might no longer receive security updates and could support only older WiFi encryption (WPA2 or worse). You should get a router with WPA3 at the very least.

Even if the hardware works perfectly, unsupported firmware with known vulnerabilities puts your entire network at risk.

When Used Routers Are Relatively Safe

Recent Models with Current Support

If you're buying a router that's only 1-2 years old and still receiving firmware updates from the manufacturer (check the manufacturer's website for your specific model), the hardware is likely in good condition and security support is current.

Generally speaking, used routers do not pose a security risk and are unlikely to be compromised by previous owners, provided you take proper precautions upon receiving them.

From Reputable Refurbishing Companies

Purchasing from established refurbishing companies (manufacturer refurbished programs, reputable retailers like Amazon Renewed or Best Buy) is much safer than buying from individuals. These companies typically:

• Factory reset all equipment
• Reflash firmware to factory versions
• Test functionality
• Provide limited warranties (30-90 days)
• Offer return policies

The discount is smaller (typically 20-40% vs. 50-70% for individual sales) but the risk is significantly lower.

With Proper Security Procedures

Security-wise, the risk is negligible if you perform a factory reset and re-flash the firmware. Doing this should rewrite everything in programmable memory and erase anything malicious.

If you're comfortable performing these steps, used routers from individuals become much safer options.

Essential Steps Before Using a Used Router

1. Factory Reset

As soon as you receive a used router, perform a complete factory reset. This typically involves:

1. Locate the reset button (usually recessed on the back)
2. With the router powered on, hold the reset button for 10-30 seconds
3. Wait for the router to restart with factory default settings

This removes previous configuration, passwords, and network settings.

2. Update Firmware

Immediately check for and install the latest firmware:

1. Connect to the router and access its admin interface
2. Check the current firmware version
3. Visit the manufacturer's support site and download the latest firmware
4. Install it through the router's admin interface

This ensures you have the latest security patches and removes any potentially compromised firmware.

3. Reflash Firmware (Advanced)

For maximum security, especially with business-grade routers or if you're particularly cautious, reflash the firmware completely:

1. Download the official firmware from the manufacturer
2. Use the router's recovery mode or TFTP method to completely overwrite firmware
3. This rewrites all programmable memory, eliminating any potential malicious code

This requires technical knowledge but provides the highest assurance.

4. Change All Default Credentials

After resetting, immediately:

• Change the admin password from default
• Set a new, strong WiFi password
• Change the network name (SSID) if desired
• Disable WPS if not needed
• Enable WPA3 encryption if supported

Red Flags to Avoid

Don't buy a used router if:

• It's more than 3 years old (likely approaching end of support)
• The last firmware update was over 12-18 months ago
• It only supports WiFi 4 or older standards
• The seller refuses to accept returns or provide any details about its history
• The price difference between used and new is minimal (less than 30%)
• It's a cheap, budget model that wasn't worth much when new

Additionally, if your work involves highly confidential information, you should consider buying a new and secure router rather than risk any potential compromise.

Cost-Benefit Analysis

Consider the actual savings versus risk and longevity:

• A new WiFi 6 router costs $80-$200
• A used equivalent might save $30-$100
• But if it's 2-3 years old, you'll likely need to replace it sooner
• The time investment in proper security procedures has value

Sometimes buying new makes more sense, especially when sales and deals can bring new router prices close to used prices. You get full warranty, latest features, and no security concerns.

Refurbished vs. Used: Know the Difference

Refurbished routers have been professionally restored, tested, and certified to work like new. They often come from returns, overstock, or lease returns. They include warranties and have been reset and updated.

Used routers are sold as-is by individuals with no testing, restoration, or guarantees. They're cheaper but riskier.

If buying secondhand, refurbished is generally the safer choice despite the smaller discount.