Device Support-Lifespan Observatory

What vendors do, not what they announce.

ASUS

ZenWiFi XT9

Actively updated reasonably evidenced

firmware is arriving about as often as it always has

57 days since the last release against a median gap of 43 (1.3x)

Sign in to be emailed when this verdict changes.
Last firmware
4 August 2026 (2 months ago)
Releases seen
16
Update rhythm
about every 43 days
Support observed
≥4 years
Vendor's promise
no support period we can evaluate
Patch latency
not measurable — its changelogs name no CVE ids

Firmware history

  1. 3.0.0.4.388_24854 4 August 2026

    Release notes — disclosure 0.45 
    Security Fixes- Strengthened data handling in Networks configuration functions.- Improved data validation in Networks rule list processing.- Fixed a data-handling issue in the DNS query caching component.- Strengthened verification when a software component downloads - external resources, improving connection security.- Adjusted the information response mechanism of the device discovery service, strengthening protection of device information.- Fixed a data-handling issue in a firmware component on a specific model.- Improved data-display handling in a web function to enhance browsing security.- Strengthened input data validation in a device-pairing web function.- Improved data validation in the configuration file upload/sync function.- Improved how the account service restart process is handled.- Removed a non-essential internal function endpoint, strengthening overall access control.- Adjusted the debug file access mechanism, strengthening protection of internal data.- Strengthened data handling in the system logging function.We recommend upgrading to this version to maintain optimal protection.

    Archived page, fetched 29 September 2026

  2. 3.0.0.4.388_24814 18 May 2026

    Release notes — disclosure 0.35 
    Security Fixes- Enhanced DNS name handling to address a potential memory issue that could occur in rare cases during name format conversion, improving system security and robustness.- Improved safeguards for execution modules to reduce the risk of substitution during certain processes.

    Archived page, fetched 29 September 2026

  3. 3.0.0.4.388_24768 20 October 2025

    Release notes — disclosure 0.43 
    - Enhanced system stability.- Enhanced input validation and refactored legacy string handling routines to ensure robust memory management.- Addressed multiple security weaknesses in AiCloud service by enforcing strict credential verification, implementing robust file path validation, and hardening command execution logic to prevent unauthorized access and manipulation of system resources.- Implemented comprehensive validation and expanded command filtering in the web history API.- Fixed a privilege escalation vector in the IFTTT token exchange mechanism- Strengthened input validation and directory handling in the VPN configuration upload interface.- Fixed an issue that allowed certain user settings to be bypassed, improving overall user control and protection.

    Archived page, fetched 29 September 2026

  4. 3.0.0.4.388_24753 4 August 2025

    Release notes — disclosure 0.45 
    Important: After installing this firmware, we strongly recommend performing a factory-default reset to activate every new security adjustment.Security Enhancements- Password Policy Upgrade – Minimum 10 characters with at least 1 letter, 1 digit and 1 special symbol, and no consecutive identical characters; hardens defence against brute-force attacks.- HTTPS on 8443 – Management interface now served over TLS by default.- UPnP Disabled – Universal Plug and Play starts in the off state for reduced surface exposure.- AiCloud Authentication Hardening (CWE-287) – Added layered verification.- Authentication Logic Refactor – Removed redundant code paths for a lean sign-in flow.- Memory Safety Guard (CWE-476) – Introduced null-reference protections across critical services.- Enhanced IPsec Parameter Validation – The existing input checks have been hardened.- Data Exposure Mitigation (CWE-200) – Reinforced controls on sensitive pathways.- Detailed Audit Trails – Expanded logging within the authentication module.System Improvements- Connection Stability – Core algorithms refined for steadier links.- Scheduling Accuracy – Timed tasks execute reliably under PPPoE, PPTP and L2TP WAN modes.- Client List Maintenance – Resolved an issue that prevented offline devices from being removed from the client list.

    Archived page, fetched 29 September 2026

  5. 3.0.0.4.388_24710 22 April 2025

    Release notes — disclosure 0.31 
    Improved compatibility with certain IoT devices.

    Archived page, fetched 29 September 2026

  6. 3.0.0.4.388_24709 13 March 2025

    Release notes — disclosure 0.49 
    1. Fixed the UI issue in Chrome.2. Fixed client binding issues in Mesh scenarios.3. Enhanced input parameter handling techniques to improve data processing stability and system security.4. Enhance system access control mechanisms.

    Archived page, fetched 29 September 2026

  7. 3.0.0.4.388_24684 5 November 2024

    Release notes — disclosure 0.58 
    1. Strengthened input validation and data processing workflows to further protect information security.2. Enhanced AiCloud password protection mechanisms, safeguarding against unauthorized access attempts.3. Enhanced device security through improved buffer handling in connection features.4. Refined data handling processes, ensuring secure and accurate information management.5. Enhanced file access control mechanisms, promoting a more secure operating environment.6. Strengthened certificate protection, providing enhanced data security.

    Archived page, fetched 29 September 2026

  8. 3.0.0.4.388_24668 23 September 2024

    Release notes — disclosure 0.57 
    1. Optimized memory management mechanisms, improving system efficiency and stability.2. Strengthened input validation and data processing workflows, further protecting your information security.3. Improved web rendering engine, enhancing browsing experience and security.4. Enhanced security of system command processing to guard against potential malicious operations.5. Perfected JavaScript-related security mechanisms, offering a more secure web interaction environment.

    Archived page, fetched 29 September 2026

  9. 3.0.0.4.388.23285 15 May 2023

    Cites CVE-2023-35086, CVE-2023-35087

    Release notes — disclosure 0.93 
    Bug fixes and functionality modifications:-The ARP response issue has been resolved, along with the connection issue between the router and the ROG Phone 6 and 7.-Resolved the issue where the USB path is not displayed on the Media Server page in the AiMesh node-Resolved the Download Master login issue. Please click the update link in the USB Application to update it.Security updates:-Fixed the cfg server vulnerability. Thanks to Swing and Wang Duo from Chaitin Security Research Lab. -Fixed the vulnerability in the logmessage function CVE-2023-35086/ CVE-2023-35087. Thanks to Swing and Wang Duo from Chaitin Security Research Lab C0ss4ck from Bytedance Wuheng Lab, Feixincheng from X1cT34m.

    Archived page, fetched 29 September 2026

  10. 3.0.0.4.388.23012 12 April 2023

    Cites CVE-2023-28702, CVE-2023-28703

    Release notes — disclosure 1.00 
    New features:-Built-in Surfshark in VPN Fusion allows you to surf the internet anonymously and securely from anywhere by encrypting connections. Please refer to https://asus.click/SurfsharkVPN-iPhone/Android USB auto backup WAN allows you to connect your phone to the router’s USB port and use it as an internet source. Please refer to https://asus.click/AutobackupWAN-DDNS transfer allows you to transfer your ASUS DDNS hostname from your original router to the new one. Please refer to https://asus.click/ASUSDDNSBug fixes and functionality modifications:-Resolved the issue with login and password changes.-Resolved the IPSec VPN connection issues.-Resolved the Instant Guard connection issues.-Fixed the AiCloud login issue after unplugging and plugging the HDD into the USB port.-Fixed the issue where Traffic Analyzer sometimes couldn't record data.-Fixed the time display issue for the preferred upgrade time in the Auto Firmware Upgrade function.-Fine-tuned the description for port status.-Enabled DynDNS and No-IP DDNS to use IPv6.-Fixed AiMesh preferred AP identification in site survey results.-Updated timezone list for Greenland, Mexico, and Iran.-Modified the USB application option text in dual WAN.-Allowed WireGuard Server clients to access the Samba server.-Fixed memory leak issue.-Enabled the failback function when using the iOS/Android USB backup WAN.Security updates:-Enabled and supported ECDSA certificates for Let's Encrypt.-Enhanced protection for credentials.-Enhanced protection for OTA firmware updates.-Fixed DoS vulnerabilities in firewall configuration pages. Thanks to Jinghe Gao's contribution.-Fixed DoS vulerabilities in httpd. Thanks to Howard McGreehan.-Fixed information disclosure vulnerability. Thanks to Junxu (Hillstone Network Security Research Institute) contribution.-Fixed CVE-2023-28702 and CVE-2023-28703. Thanks to Xingyu Xu(@tmotfl) contribution.-Fixed null pointer dereference vulnerabilities. Thanks to Chengfeng Ye, Prism Research Group - cse hkust contribution.

    Archived page, fetched 29 September 2026

  11. 3.0.0.4.388.22525 15 February 2023

    Cites CVE-2022-468712

    Release notes — disclosure 0.70 
    1.Fixed CVE-2022-468712.Fixed Client DOM Stored XSS.3.Improved AiMesh backhaul stability.4.Fixed AiMesh topology UI bugs.5.Fixed the reboot issue when assigning specific clients in VPN fusion.6.Fixed the VPN fusion bug when importing the Surfshark WireGuard conf file.7.Fixed network map bugs.

    Archived page, fetched 29 September 2026

  12. 3.0.0.4.388.22068 5 January 2023

    Release notes — disclosure 0.44 
    1. Improved system stability.2. Fixed the IPsec VPN compatibility issue with Win10.3. Fixed the VPN fusion user interface issues under the HTTPS connection.4. Fixed Client DOM Stored XSS vulnerability.5. Improved Wireguard performance.

    Archived page, fetched 29 September 2026

  13. 3.0.0.4.388.21963 8 December 2022

    Cites CVE-2022-406176

    Release notes — disclosure 0.91 
    1. Fixed IPTV compatibility issue with Movistar. Thanks to Sergio de Luz from RedesZone.net.2. Fixed VPN fusion, AiMesh, and Network map GUI bugs.3. Fixed WAN compatibility issue with Starlink router.4. Fixed miniupnpc vulnerabilities, CVE-2015-603, CVE-2017-10004945. Fixed IPSec server vulnerability, CVE-2022-406176. Improved connection speed with Verizon FIOS.

    Archived page, fetched 29 September 2026

  14. 3.0.0.4.388.21429 9 November 2022

    Release notes — disclosure 0.33 
    1. Fixed AiMesh prelink issue.2. Improved system stability.3. Fixed 2.5GbE port compatibility issue.

    Archived page, fetched 29 September 2026

  15. 3.0.0.4.388.21069 28 September 2022

    Cites CVE-2018-1160

    Release notes — disclosure 0.91 
    1. Fixed Samba file system clutter bug.2. Improved AiMesh system backhaul TXBF speed.3. Fixed AiProtection bug.4. Security- Fixed HTTP response splitting vulnerability. Thanks to Efstratios Chatzoglou, University of the Aegean.- Fixed status page HTML vulnerability. Thanks to David Ward.- Fixed CVE-2018-1160. Thanks to Steven Sroba.- Fixed cfg_server security issue.

    Archived page, fetched 29 September 2026

  16. 3.0.0.4.388.20842 1 September 2022

    Release notes — disclosure 0.54 
    1. Improved system stability.2. Supported WireGuard server/client.3. Suppored VPN fusion. It can easily achieve VPN connection to network devices like Smart TV, Game console and without installing the VPN client software.4. Supported new device connection notification.5. Supported DNS-over-TLS6. Supported connection diagnostic on ASUS router app.7. Upgraded parental control and added reward, new scheduler, safe browsing.8. Improved Channel Availability Check process.9. Improved AiMesh stability.10. Fixed GUI bugs.

    Archived page, fetched 29 September 2026

Evidence

One archived page sits behind this record, the earliest read on 2 August 2026. Everything above was read from it, and each is kept byte for byte so it can be checked after the vendor edits the original.

Identifiers: marketing_name ZenWiFi XT9

Judged by lifecycle-1 on 30 September 2026. How these verdicts are computed.

Machine-readable: JSON · RSS