Managing Network Equipment End of Support and Firmware Updates

For small and mid-sized businesses, the way to avoid running network equipment (UTMs, firewalls, VPN appliances, routers and Wi-Fi access points) past its support period is to do three things: (1) build an inventory of every device, (2) check each device's maintenance contract and end-of-support (EOS) date, and (3) decide who updates firmware and how often. If you build the inventory yourself the cost is zero, and outsourcing update work typically runs from a few thousand yen to tens of thousands of yen per month as a general guide.

- Point 1: Perimeter devices visible from outside (VPN appliances, UTMs, routers) are the first to be attacked once a vulnerability is disclosed. Exploitation of VPN and UTM products has continued through 2026
- Point 2: In small companies, the common problems are leaving everything to the installer and nobody noticing when a maintenance contract lapses. Start by making devices, contract dates and owners visible in an inventory
- Point 3: Devices past end of support (EOS) receive no fixes. Budgeting a year ahead of the deadline and replacing them is the safe approach

PCs and smartphones are used in front of a screen, so users get chances to notice an update prompt. Network equipment, by contrast, often runs for years without anyone looking at its screen, so updates are easily forgotten. UTMs, firewalls, VPN appliances and routers also sit at the boundary between the internal network and the internet, which makes them an entrance that attackers can easily find from outside and that gives access to the internal network if breached.

When a vulnerability (a flaw in the software) in these devices is disclosed, attackers automatically scan the internet for devices that have not been patched. In 2026 as well, VPN and UTM vulnerabilities have continued to be exploited. As in the explanation of the SonicWall SSLVPN vulnerability, the entrance stays open unless the fix is actually applied, even after it is released.

Three things tend to pile up in small businesses. Everything was left to the installer and nobody is assigned to update. Nobody tracks when maintenance contracts renew. Nobody knows how many devices exist or where they are. This article is about resolving those three. You do not need a dedicated department: one inventory sheet and a few checks a year are enough.

Management starts with knowing what is where. No special software is needed; a single spreadsheet will do. Proceed in this order.

1. Walk the site: Check the office, warehouse, shops, factory, server room and ceiling spaces, and photograph the model labels
2. Collect contracts and invoices: Look for purchase quotes, lease contracts, maintenance contracts and license (annual contracts for antivirus or intrusion prevention) documents
3. Ask the installer: Get a list of devices and the contract dates the vendor has on record
4. Fill in the inventory: Record the items in the table below, one row per device
5. Assign an owner: Pick one person (general affairs, an executive or a one-person IT staffer) to own the inventory, and set two review dates a year

Example items for the inventory are shown below. You do not have to fill every cell at first. The devices with the most blanks are the riskiest ones.

Do not write admin passwords in the inventory itself. Keep them in a safe or a password manager and record only where they are stored. The inventory itself contains network information, so limit who can view it.

Terms about product lifespan look similar, so let us sort them out first. Names and periods differ by manufacturer, so read the following as a general framework.

The key point is that a device past EOS no longer receives fixes for new vulnerabilities. The device works as usual, so this is hard to notice, but in terms of defense it is close to using a door with a broken lock. The same problem occurs with PC operating systems, as covered in how to prepare for end of support.

To check EOS:

- Check the manufacturer's website: Search by model and look for pages such as product lifecycle, end-of-support notices or EOL/EOS policy
- Ask your maintenance contact: Give the installer the model numbers and ask for the EOS date and the end of firmware provision in writing (email is fine)
- Check the admin screen: Some devices show support status or license expiry
- Do not overlook end-of-sale notices: The gap between end of sale and actual end of support is generally some years, but it varies by manufacturer and product, so always check individually

Record the confirmed date in the inventory's EOS column, and make it a rule to start budgeting for replacement 12 months before the end date.

Firmware is the basic program running inside a device, similar to an OS on a PC. Manufacturers distribute fixes for defects and vulnerabilities as firmware updates. Fixes are not applied unless you update. Some routers and Wi-Fi products update automatically, but UTMs and VPN appliances often require someone to apply updates manually.

A realistic approach has two tiers.

- Regular check (about four times a year): Every three months, check whether a newer version exists for each device in the inventory
- Urgent response (as needed): When a manufacturer or public agency announces a serious vulnerability, aim to respond within days, especially for exposed devices such as VPN appliances and UTMs

Urgent notices arrive through manufacturer emails and public advisories. Registering your products with the manufacturer lets you receive notices, so register your own email addresses, not only the installer's contact. Also check that notices are not still going to the personal email of a departed employee.

The basic update procedure is as follows.

1. Save current settings: Export the configuration file before updating
2. Read the release notes: Check the fixes and cautions (prerequisites, required version order)
3. Set the work time: Communication may stop for minutes to tens of minutes during the update. Do it outside business hours and notify those affected
4. Apply the update: Follow the manufacturer's procedure. Do not cut the power
5. Verify operation: Check internet access, VPN connections, inter-site links and Wi-Fi
6. Roll back if needed: Confirm in advance how to restore the previous version
7. Record it: Enter the update date and version in the inventory

Decide who does the work according to the importance of the device.

A common problem is a gap in understanding: the vendor did not include update work in the maintenance scope, but the company assumes the vendor is doing it. Always confirm in writing whether updates are included. For the broader approach to updating PCs and servers, see the patch and update management guide for SMBs.

There are several types of maintenance contracts, and costs vary with the content. The figures below are general market ranges only. They vary greatly with device type, quantity, manufacturer and terms, so read them as a guide and always obtain quotes from several companies.

An easily overlooked point is that the device maintenance and the licenses (intrusion prevention, web filtering, etc.) may be separate contracts. Even if maintenance continues, detection features may not run once licenses expire. That is why the inventory tracks license expiry in its own column. The overall picture of UTM hardware and license costs is covered in UTM cost guidelines.

Also note that even with a maintenance contract, if the manufacturer has ended support, the vendor cannot obtain fixes even if it wants to keep maintaining the device. Having a maintenance contract and being within the manufacturer's support period are different things.

Rather than "it still works, so keep using it," the following criteria make decisions easier.

- Manufacturer support has ended (or will within a year): Plan replacement as the top priority
- An exposed device (VPN appliance, admin screen visible from outside) cannot be updated to the latest firmware: Highest priority
- More than five years since installation: Even within the manufacturer's period, performance shortfalls and failure risk rise. Use age as a check guideline (actual lifespan varies by device)
- Maintenance contract has lapsed and has been neither renewed nor replaced: Decide quickly whether to reinstate it or replace the device
- Features no longer match the business: More remote work, new sites, higher traffic, more Wi-Fi devices, etc.
- No owner and nobody understands the settings: Replacement is a good chance to reorganize the configuration

Replacement cost varies widely with scale and contract type (purchase, lease or monthly). For small-office UTMs and routers, a general guide is tens of thousands to a few hundred thousand yen for the hardware, plus tens of thousands to over 100,000 yen for installation and configuration (varies with model and conditions). Leasing spreads the cost monthly, but early termination during the term is hard.

When replacing, it is also important to avoid copying old settings as they are and instead clean up unused VPN accounts, opened ports and unused external publishing settings. Settings accumulated over years of operation can become weaknesses themselves.

After building the inventory, asking your installer or maintenance vendor the following questions helps prevent misunderstandings. Get answers in a form that leaves a record, such as email.

1. Please tell us the list of our devices (model, location, firmware version)
2. When is each device's manufacturer end-of-support date (EOS)?
3. Does the maintenance scope include firmware updates? If so, at what frequency and by what method?
4. When a serious vulnerability is announced, within how many days will you contact us and respond?
5. When do the licenses (intrusion prevention, web filtering, etc.) expire? When will the renewal notice come?
6. If an update fails, how is it rolled back and where does responsibility lie?
7. Is the admin login visible from outside? Is multi-factor authentication in use?
8. Are configuration backups taken? Where are they stored?
9. When will replacement be needed, and what is the rough estimated cost?
10. At contract end, will you hand over device configuration and admin accounts?

Question 3 is especially important. Even if you believe you are safe because you have a maintenance contract, it is not uncommon for it to cover only hardware failure replacement and exclude firmware updates. Conversely, if updates are included, ask for records of when, by whom and on which devices, so you can check them against the inventory's last-update dates.

- [ ] Listed all UTMs, firewalls, VPN appliances, routers and Wi-Fi access points in the office and at each site
- [ ] Created a device inventory (model, location, install date, firmware, maintenance expiry)
- [ ] Assigned one owner and set two review dates a year
- [ ] Checked each device's manufacturer end-of-support date (EOS) and entered it
- [ ] Checked maintenance contract and license expiry separately
- [ ] Identified devices exposed externally (VPN ports, admin screens)
- [ ] Decided in writing who updates firmware (in-house or vendor) and how often
- [ ] Registered several of our own email addresses to receive manufacturer notices
- [ ] Backed up settings before updating and confirmed how to roll back
- [ ] Set a rule to budget for replacement 12 months before end of support
- [ ] Cleaned up unused VPN accounts and unused settings
- [ ] Received the vendor's answers to the question list in writing