Who promises firmware for how long? UniFi, MikroTik, LANCOM and AVM compared

Only one of these four vendors gives your specific model a date on which firmware maintenance ends. That vendor is LANCOM — trading as Rohde & Schwarz Networks and Cybersecurity since 1 July 2026. MikroTik states a minimum duration but no date. Ubiquiti and AVM state neither. If you came here looking for a dated UniFi EOL list: there is none, and that is not an oversight.

What counts as a commitment

A support commitment you can plan around has three properties. It names a duration or a date. It applies to a model, not to a product family. And you can read it before you buy, not after you file a ticket. A status page that ticks “still supported” today fails the first two: it tells you where you stand, never how long you will stand there.

LANCOM: dates, with a catch two years in

A device reaches End of Sale when it leaves the price list. From that point the lifecycle policy promises at least two more years of release updates and security updates at no extra charge. End of Life follows five years after End of Sale; after that there are no updates at all. The product tables carry three date columns per model: EOS date, end of major releases, EOL date — for the IAP-822 access point, for instance, July 2026, July 2028 and July 2031. That is what a plannable commitment looks like.

Read the current policy table carefully, though. From two years after EOS, security updates continue only with an R&S NC support or replacement product — or within the warranty, which is at least three years from the factory and five for managed switches. So the free part of the commitment ends at EOS + 2; the stretch to EOL is something you buy.

Ubiquiti: two words instead of two dates

Ubiquiti publishes one page of Vintage and Legacy products. Vintage means no further development, but critical bug fixes and security updates continue. Legacy means updates have stopped. Both are states, not schedules: no duration, no notice period, no date on which a device moves from one to the other. A model can appear on that list the day you read it.

This is not an obscure complaint. Four separate threads in Ubiquiti’s own community ask for exactly this commitment — for a roadmap and product lifecycle, for a published EOP/EOS/LTS/EOL policy, for a formal lifecycle policy for all general release hardware and for a list of hardware support dates. None of them is answered with one. The clearest reply comes from another customer: that list is all there is, Ubiquiti does not publish roadmaps.

Why that matters beyond procurement paperwork: as of 19/08/2026, patchletter holds three entries for UniFi OS in the CISA catalogue of known exploited vulnerabilities — all three rated CVSS 10, all three added on 23/06/2026 with a remediation deadline of 26/06/2026 for US federal agencies. Three days. For the six other products this article draws on — UniFi Network, UniFi Protect, RouterOS, LCOS and the FRITZ!Box 7530 and 7510 — there is no entry. When the clock runs that fast, “we ship updates when we consider it necessary” is not something you can plan against.

MikroTik: a commitment in the product-page footnote

MikroTik’s router and switch product pages all end with the same sentence — on the hAP ax³ page as on the CCR2004 or the hEX: the device includes free software updates for the life of the product or a minimum of five years starting from date of purchase. That is a real duration, and more than Ubiquiti or AVM offer. It is also tied to the one date the vendor does not know: yours. Two identical routers bought three years apart have different end dates, and nothing on the site tells you either of them.

The architecture helps and hurts in equal measure. RouterOS is packaged per CPU architecture, not per device, so an older device gets the same current release as a new one for as long as its architecture is still built. But fixes land at the head of a release chain — long term, stable, testing, development — not in the branch you froze two years ago. endoflife.date puts it plainly: the RouterOS release and support policy is not clearly defined.

AVM: a status, not a date

The product support status page carries five columns per model: model, knowledge base, personal support, current version and FRITZ! manufacturer’s warranty — and not a single date. AVM commits there to supporting all FRITZ! products with free updates, but names no point at which that stops. So you learn whether your model is still being maintained today, not for how much longer.

The manufacturer’s warranty does not close the gap. Its length, AVM says, is stated in the manual or quick guide of the individual product, and the warranty terms deal with defects and repair — firmware is not mentioned. Version numbers do not help either: on 07/08/2026 AVM dated FRITZ!OS 08.25 for the FRITZ!Box 7530 and 08.26 for the 7510. Same vendor, same day, separate branches — “my FRITZ!OS is current” answers a different question than “is my model still maintained”.

From December 2027 this stops being goodwill

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) requires manufacturers to determine a support period during which vulnerabilities are handled, and to state its end date — month and year — clearly at the time of purchase. Article 13(8) sets a floor of five years; recital 60 notes that network devices such as routers and switches are typically in use longer and should get correspondingly longer periods. The main obligations apply from 11 December 2027 to products placed on the market from that date. Devices placed on the market before then are covered only if they are substantially modified afterwards — which is exactly why the question is worth asking now.

What to ask before you order

• The end date of the support period for this SKU, as month and year — not the product family, not “currently supported”.
• Whether security updates up to that date are free or require a support contract.
• How a change to that date is announced, and with how much notice.
• Whether the management software will keep adopting the device after that date, or only display it.

For a tender, one sentence carries all four: “For each device offered, the supplier states the end date of the support period with month and year, indicates whether security updates up to that date are provided at no additional charge, and reports any change to that date during the contract term.” From December 2027 that is a duty for new products anyway. Until then it is the question that separates vendors who have an answer from vendors who have a status page.

Where nothing is promised, the release rhythm is the signal

For three of these four vendors you cannot look up when maintenance ends. What you can observe is whether it is still happening, and how the pace changes. A model that received firmware every few weeks and has now been quiet for eight months has told you something, even if nobody wrote it down.

As of 19/08/2026 every one of the four vendors had published something within the previous four weeks. The most recent versions recorded by patchletter were UniFi OS 5.1.26 (29/07/2026), UniFi Protect 7.2.105 (14/08/2026), MikroTik RouterOS 7.24 (18/08/2026), LANCOM LCOS 10.94.0327 (26/07/2026) and FRITZ!OS 08.25 for the FRITZ!Box 7530 (07/08/2026). Nothing there is alarming. The point is that this is the only thing you can actually measure — and it is only worth anything if you keep measuring it.

Tracking that by hand across four vendors is the part nobody keeps up. patchletter follows each of these products on its own page — UniFi OS, MikroTik RouterOS, LANCOM LCOS and FRITZ!Box 7530 — with the history of previous releases and an email when a new firmware ships. When something last arrived is then on the page rather than in your memory. Known exploited flaws in tracked products are on the CVE page. Free, no account, hosted in Germany.

The honest limitation

A release rhythm is evidence, not proof. A quiet quarter can mean there was nothing to fix; a burst of releases can mean a bad quarter rather than a healthy one. And patchletter holds no support cycles for any of the products discussed here, because these vendors publish none in machine-readable form — the LANCOM dates in this article come from the vendor’s own tables, read by hand. Where a vendor states a date, use the date. Where none exists, the release history is the second-best signal available, and still better than an assumption.

patchletter figures from our own dataset as of 19/08/2026: latest recorded versions with the vendor’s date, plus three CISA KEV entries for UniFi OS (all CVSS 10, added 23/06/2026, deadline 26/06/2026). No support cycles are held for these products. All vendor policies retrieved 19/08/2026 from the pages linked above; LANCOM Systems has traded as Rohde & Schwarz Networks and Cybersecurity since 01/07/2026. Vendor policies change without notice — treat every date here as the state of that day.