Network router

Home or office router carrying all connected traffic to the internet.

A router is a high-value target because it sits at the network edge. Its CRA documentation has to cover the network stack, the management interface and the update mechanism, and the risk assessment has to reflect that a compromise of the device compromises the whole network behind it.

Where this device type sits in the Regulation

In the Regulation's own structure, 'routers, modems and switches intended for connection to the internet' are named in Annex III Class I (Regulation (EU) 2024/2847, Art. 32(2)). Whether THIS specific router is caught by that named category is the manufacturer's guided questionnaire answer, never an assumption of this site.

CRA importance classes for this product type

All other products (default class) Important class I (Annex III) Important class II (Annex III) Critical class (Annex IV)

Typical components

• Linux kernel
• Wi-Fi driver
• VPN / firewall stack
• Web management UI
• TLS library

Most relevant Annex I requirements

• I.2(j) — limit the attack surface of the management interface
• I.2(c) — timely security updates for the router firmware
• I.2(i) — minimise negative impact on other devices and networks

Examples

• Home Wi-Fi router
• VPN router
• Office firewall/router