Updated : Revised to correct outdated details and make the guidance easier to follow.
FragAttacks is the name of a group of Wi-Fi flaws disclosed on May 11, 2021. They involve how devices combine or split wireless data frames. The practical step is to check updates for your router and connected devices, rather than assume that changing the Wi-Fi password fixes them.
What were the FragAttacks vulnerabilities?
Mathy Vanhoef reported three design issues and nine implementation issues. Attackers generally need to be within Wi-Fi range; the conditions vary by flaw and device.
The original research describes devices tested in 2021. Its results do not prove that every current device is unpatched.
| Term | Plain-English meaning |
|---|---|
| Aggregation | Combining smaller pieces of network data into a larger frame. |
| Fragmentation | Splitting a frame into smaller pieces and putting them back together. |
| Implementation flaw | A mistake in the software or firmware of a particular product. |
Does WPA3 protect against FragAttacks?
The design issues also affected WPA3. Stronger encryption remains useful, but choosing it or changing a password does not patch the affected code.
Use the strongest supported security setting that works with your devices, and check firmware separately. A VPN or HTTPS can protect some traffic, but neither replaces the relevant software update.
Which devices should you check?
- Your main router or access point. Include any mesh units or range extenders.
- Computers and phones. Install supported operating system and Wi-Fi driver updates.
- Smart-home equipment. Check cameras, televisions and other devices that may have a separate update process.
- Old equipment. Find out whether the maker still provides security updates.
A mobile-network router can still use Wi-Fi inside the home. The difference between its 4G or 5G internet connection and its local wireless network is covered in our 4G and 5G router guide.
How to check whether your router has a fix
- Find the exact model and hardware revision on the label or in the router’s settings.
- Open that model’s support page on the manufacturer’s official website.
- Compare the installed firmware with the available version and read its security notes.
- Follow the maker’s update instructions. If your internet provider supplies the router, ask whether it manages firmware updates.
- If the product is no longer supported, consider replacing it rather than treating a password change as a security patch.
A firmware file for a similar-looking model can be wrong for yours. Do not install it unless the maker specifically lists your exact model and revision.
For an example of model-specific guidance, see TP-Link’s FragAttacks advisory. Use the advice for your own model rather than another product’s firmware number.
What should you do if no update is listed?
Ask the manufacturer or provider whether the model was affected and whether a fix is included in a later release. A general “latest firmware” label is less useful than a clear security advisory. Avoid claiming a device is safe or unsafe from its age or Wi-Fi generation alone.
Keep sensitive browsing on HTTPS sites and avoid exposing unnecessary device services to the internet. These are useful general habits, but they do not show that FragAttacks has been fixed. For the connection options themselves, see fiber, 5G and satellite internet compared.