To check your home network for vulnerable devices, first secure the router (current firmware, WPA2 or WPA3, new admin password, WPS and remote management off), then check every device for risky services such as Telnet, SMBv1, FTP and login pages without HTTPS, and for models or software on CISA's Known Exploited Vulnerabilities list. Fix the worst first, then recheck.
The check, step by step
- Secure the router first. Update its firmware, change the admin password, use WPA2 or WPA3, and turn off WPS, remote management and, if unused, UPnP.
- List every device on the network. Use your router's device list or a network scanner, and name the devices you recognize.
- Check each device's services. Look for Telnet, SMBv1, FTP, VNC, login pages without HTTPS and outdated TLS. A scanner such as NetSamurai checks these for you.
- Check for known exploited flaws. Compare device models and software versions with CISA's Known Exploited Vulnerabilities catalog.
- Fix the worst first. Start with known exploited and high-severity findings: update firmware, turn off risky services, or replace end-of-life devices.
- Recheck and repeat. Check each device again after changing it, and rescan the network every few weeks or after adding new devices.
Secure the router
Every device on your network sits behind the router, so it's the first thing to get right.
- Update the router's firmware. Turn on automatic updates if it has them. If the maker has stopped releasing updates, plan to replace it.
- Change the admin password. Use a unique password for the router's admin page, not the default printed on the label.
- Use WPA3, or WPA2 with AES. Avoid WEP, WPA and WPA2 with TKIP. Use a long Wi-Fi password.
- Turn off WPS. Wi-Fi Protected Setup lets devices join with a PIN or button press, and the PIN can be guessed.
- Turn off remote management. Unless you need to manage the router from outside the house, its admin page shouldn't be reachable from the internet.
- Turn off UPnP if you don't need it. It lets devices open ports to the internet without asking.
- Use a guest network for visitors and smart gadgets. Keeps cameras, plugs and guests away from your computers and NAS.
Device weaknesses, and how to fix each one
These are the weaknesses that turn up most on home networks, roughly in the order you'll meet them.
Telnet is turned on High
Why it matters: Telnet is a 1960s-era way to log in to a device that sends everything, including the password, unencrypted. Botnets such as Mirai spread by trying default Telnet passwords on cameras and routers.
How to fix it: Turn Telnet off in the device's settings. If there's no switch, update the firmware; if it still can't be turned off, replace the device or keep it on an isolated guest network.
Old file-sharing protocol (SMBv1) High
Why it matters: SMBv1 is the version of Windows file sharing that the WannaCry and NotPetya outbreaks spread through. Microsoft has deprecated it, but older NAS boxes and PCs still accept it.
How to fix it: Turn off SMB1 in the NAS or computer settings and use SMB2 or SMB3. Update firmware first if the option is missing.
Password page without encryption Medium
Why it matters: A login page served over plain http:// sends your password across the network readable by anything on the same Wi-Fi.
How to fix it: Turn on HTTPS for the device's admin page, or switch to its app if it offers encrypted management. Change the password afterwards.
Unencrypted file transfer (FTP) Medium
Why it matters: FTP sends files and logins in the clear. NAS devices and some printers leave it on by default.
How to fix it: Turn FTP off if you don't use it, or switch to SFTP or FTPS.
Outdated encryption (TLS 1.0 or 1.1) Medium
Why it matters: TLS 1.0 and 1.1 are retired encryption versions with known weaknesses. A device that chooses them is usually running old firmware.
How to fix it: Update the firmware. Many devices also have a setting for the minimum TLS version.
Screen sharing (VNC) reachable Low
Why it matters: VNC gives remote control of a computer's screen. Exposed without a strong password, it hands over the whole machine.
How to fix it: Turn screen sharing off when you don't need it, and require a strong password when you do.
Router lets devices open ports (UPnP) Low
Why it matters: UPnP lets any device at home ask the router to open a port to the internet, with no password. Malware on one device can use it to expose others.
How to fix it: Turn UPnP off in the router if nothing you use needs it, such as game consoles or some video-call apps.
Known exploited vulnerabilities Critical
Why it matters: Some flaws aren't just possible to exploit; attackers are known to be using them. CISA, the US cybersecurity agency, keeps a public Known Exploited Vulnerabilities (KEV) catalog of them, and many entries are consumer routers, cameras and NAS boxes.
How to fix it: Update the device to the maker's fixed firmware. If the model is end-of-life and no fix exists, replace it; that is often the case for older D-Link, NETGEAR and Zyxel routers on the list.
Run the check with NetSamurai
- Install NetSamurai on your iPhone or iPad and connect to the Wi-Fi network you want to check.
- Agree to scan only networks you own or may assess, and allow Local Network access.
- Tap Scan. Name the devices you recognize and mark them as yours.
- Open a device and tap Check this device for a free Quick check of its common ports. With Pro, check all devices in one batch.
- Open the Security tab. Findings are listed worst first; each explains what was seen, why it matters and how to fix it.
- After fixing, check the device again. The finding is marked resolved only when a check shows the problem is gone.
NetSamurai's checks are read-only: it never logs in, tries passwords or exploits anything. See what the checks look for.
What a scan can't tell you
- "No issues found" isn't a guarantee. It means none within the checks performed. Some problems can't be seen from the network.
- Version matches are "potentially affected". Vendors often fix flaws without changing the version number.
- A local scan doesn't test the internet side. It can't tell what is reachable from outside your home.
- It doesn't watch traffic. Malware, intrusions and attacks in progress need different tools.
Frequently asked questions
How do I know if my home network is secure?
Check two things: the router and the devices. The router should run current firmware with WPA2 or WPA3, a non-default admin password, and WPS and remote management turned off. Then check each device for risky services such as Telnet, SMBv1 and unencrypted login pages, and for models or software with known exploited vulnerabilities. A clean result from those checks is a good sign, though no scan can prove a network is completely secure.
Can I scan my home network for vulnerabilities from my iPhone?
Yes. NetSamurai scans the Wi-Fi network your iPhone or iPad is connected to, checks each device's common ports with read-only protocol checks, and matches software versions and device models against reviewed CVEs and CISA's Known Exploited Vulnerabilities catalog. It is free to download, and Quick checks are free.
Is it legal to scan my own network?
Scanning a network you own or have permission to assess is generally fine, and checking your own home network is normal practice. Scanning networks that aren't yours without permission can break the law or the network's rules. NetSamurai asks you to confirm you have permission before the first scan.
What is the CISA Known Exploited Vulnerabilities catalog?
It is a public list kept by CISA, the US Cybersecurity and Infrastructure Security Agency, of vulnerabilities that attackers are known to have exploited in the real world. It is a useful way to decide what to fix first, because a flaw on the list is not just theoretical.
What is EPSS?
The Exploit Prediction Scoring System, published by FIRST, estimates the probability that a vulnerability will be exploited in the next 30 days. NetSamurai shows it next to severity and KEV status rather than combining them into one score.
How often should I check my network?
Every few weeks, after adding a new device, and after firmware updates. Comparing each scan with the previous one shows new devices and newly opened ports quickly.
Find the weak spots on your Wi-Fi
NetSamurai is free on iPhone and iPad. Quick checks and every finding with its fix cost nothing.