End of support is the point in a connected product’s life cycle after which the manufacturer stops delivering security updates, bug fixes and, in many cases, the cloud services the device depends on. In smart home privacy, it marks the moment a camera, smart lock, hub or voice assistant turns from a maintained product into an unpatched device on the home network, whose known vulnerabilities will never be closed.
The date matters because smart home devices often stay installed for five to fifteen years, while vendors may support them for far less. A device that still works physically can therefore become the weakest link in a home, exposing video, audio, presence data and network access long after its owner has forgotten about it.
What happens when a device reaches end of support
When a smart home device reaches end of support, its firmware is frozen at the last released version. Any vulnerability discovered afterwards, whether in the vendor’s own code or in a shared component such as an embedded Linux kernel, TLS library or Wi-Fi stack, stays exploitable indefinitely. Attackers know this and actively scan for outdated firmware versions because each one comes with a public list of weaknesses.
The consequences go beyond missing patches. Many devices rely on vendor cloud infrastructure for remote access, account login, video storage and automation. Vendors frequently retire those services together with the hardware line, so the device may lose features entirely, fall back to a limited local mode, or stop working altogether. The table below separates the stages that are often confused.
| Stage | What the vendor still provides | Risk to the household |
|---|---|---|
| End of sale | Full updates and cloud services, no new units sold | Low, device remains maintained |
| End of feature updates | Security patches only | Low to moderate |
| End of security support | No patches, cloud may still run | High, new flaws stay open |
| End of service | No patches and no cloud backend | High, plus loss of functions |
Vendors use these labels inconsistently, so the phrase end of life may refer to any of the last three stages. The practical question is always the same: will this device receive another security fix?
Why unsupported devices threaten privacy
An unsupported device threatens privacy in two directions. First, it can leak its own data: camera streams, microphone recordings, door lock events and occupancy patterns. Second, it can serve as a foothold inside the home network, from which an attacker reaches laptops, phones and network storage that would otherwise be unreachable from the internet.
Unpatched consumer devices are a common source of recruits for an IoT botnet, because they are always on, rarely monitored and often reachable through UPnP port forwarding or exposed management services. Once compromised, the device may also be used to observe local traffic, perform DNS manipulation or relay attacks against other targets, all without visible symptoms for the owner.
| Device type | Main privacy exposure | Network exposure |
|---|---|---|
| Indoor camera | Live video and stored clips | Often reachable for remote viewing |
| Smart speaker | Voice recordings and room audio | Persistent cloud connection |
| Smart lock | Entry history and presence patterns | Usually via a bridge or hub |
| Smart TV | Viewing habits and content recognition data | Large attack surface, many apps |
| Hub or bridge | Data from every paired device | Central position on the network |
How long smart home devices are supported
Support periods vary widely and were historically not disclosed at purchase. Large platform vendors tend to support flagship hubs and speakers for many years, while low-cost devices from white-label manufacturers may receive few or no updates even while still on sale. There is no industry-wide minimum, and support often ends quietly through a notice in an app rather than a clear announcement.
Regulation is changing this. The consumer IoT baseline ETSI EN 303 645 requires manufacturers to publish a defined support period and to keep devices updatable. The UK PSTI regime makes disclosure of the minimum security update period a legal obligation for connectable products sold in the United Kingdom since April 2024. The EU Cyber Resilience Act goes further and requires security updates for a support period reflecting expected product use, normally at least five years, with its main obligations applying from December 2027. The U.S. Cyber Trust Mark program also expects participating products to state how long they will receive updates.
| Framework | Scope | Requirement on support |
|---|---|---|
| ETSI EN 303 645 | Voluntary consumer IoT standard | Publish the support period, keep software updatable |
| UK PSTI regime | Mandatory in the United Kingdom | Disclose the minimum update period at sale |
| EU Cyber Resilience Act | Mandatory in the European Union | Provide updates for the declared period, usually five years or more |
| U.S. Cyber Trust Mark | Voluntary label in the United States | State the update period to buyers |
Managing devices that approach end of support
The safest response is planned replacement, but replacement is not always immediate. A household can reduce the risk considerably while it decides, as long as it treats the device as untrusted from that date onward. The decision table summarizes common situations.
| Situation | Recommended action | Reason |
|---|---|---|
| Camera or microphone device | Replace promptly | Highest privacy impact if compromised |
| Simple sensor on a local protocol | Keep behind a supported hub | No direct internet exposure |
| Wi-Fi plug or bulb | Move to an isolated network | Limits lateral movement |
| Device with dead cloud service | Check for local control or retire | Remaining functions may be unsafe |
| Supported open firmware exists | Consider a maintained replacement firmware | Restores patching where compatible |
Useful interim measures include IoT network isolation on a guest or VLAN segment, disabling UPnP and remote access, blocking the device’s internet access where local control suffices, and changing any default password that remains. Before disposal, a factory reset and removal from the vendor account prevent the next owner, or a recycler, from accessing stored credentials and history.
Common mistakes and misconceptions
- Assuming a working device is safe. Physical function says nothing about whether its software is still maintained.
- Ignoring the support period at purchase. A cheaper device with a short or undisclosed period often costs more over its lifetime.
- Relying on the router alone. A firewall does not stop a device that opens its own outbound cloud connection.
- Forgetting hidden devices. Bridges, doorbells and old streaming sticks are easily overlooked when auditing a home.
- Reselling without a reset. Unsupported devices passed on with linked accounts can expose the previous owner’s data.
A related misconception is that automatic updates remove the need for attention. Automatic updates only help while the vendor still publishes them; after end of support, the update channel simply delivers nothing, and the device gives no warning that it has become vulnerable.
Understanding it simply
End of support is the day a company stops looking after a device it sold you. The camera, speaker or smart plug keeps working, but nobody will repair the security holes that are found in it from then on.
Think of it like a house where the builder no longer replaces broken locks. The door still opens and closes, but once burglars learn which lock is weak, it stays weak. The key takeaway: an unsupported smart device should be isolated or replaced, especially if it has a camera or a microphone.
Applied in practice
A family has used the same indoor camera in its living room for seven years. The vendor announces that the model will receive no further firmware updates and that cloud recording will end in six months. Shortly afterwards, a security researcher publishes a flaw that allows remote access to the camera’s video stream on older firmware.
The family reviews its devices, finds two other unsupported products, a Wi-Fi bridge and an old smart plug, and moves them to a separate guest network with no access to the main computers. It replaces the camera with a model whose packaging states a support period of at least five years, factory resets the old camera and recycles it. The outcome is a home network without an exposed camera and a short list of devices to recheck each year.