The researchers racing against routers and hackers Award-winning ASU research reveals more than 1 million vulnerable routers and cameras still online If your router still works, why replace it? That logic has kept countless aging internet-connected devices alive long past their intended lifespan: Old Wi-Fi routers keep humming in closets. Outdated security cameras continue watching front porches. These forgotten network devices solider on for years after manufacturers stop supporting them. New research from Arizona State University suggests that many of those devices may still be vulnerable to publicly known cyberattacks, and their owners likely have no idea. Hui Jun Tay, a computer science doctoral student focused on cybersecurity in the School of Computing and Augmented Intelligence, part of the Ira A. Fulton Schools of Engineering at ASU, led the study and presented its findings at the 2026 Institute of Electrical and Electronics Engineers Symposium on Security and Privacy, earning a Distinguished Paper Award at the conference. The research challenges one of cybersecurity’s most trusted assumptions — that responsible disclosure reliably protects users once a vulnerability becomes public. For many years, the process has been considered a cornerstone of cybersecurity. Researchers who discover a flaw typically report it privately to a vendor, giving the company time to investigate, identify affected products and develop a fix before details are released publicly. The idea is to patch the hole before attackers can exploit it. Working under the supervision of Yan Shoshitaishvili and Fish Wang, both Fulton Schools associate professors of computer science and engineering, Tay and collaborators found that millions of devices may be slipping through the gaps in that process. “We kept finding these overlaps where the same vulnerability affected multiple devices, but only some of the devices were reported,” Tay says. “That made us wonder how many more are out there.