D-Link don't actually do anything like what you or I might call R&D or even software development. These products are absolutely riddled with security flaws, but

D-Link don't actually do anything like what you or I might call R&D or even software development. These products are absolutely riddled with security flaws, but the brands haven't caught on yet. I think really understanding why requires a bit of background, which I'll attempt to provide: Brands like D-Link solicit stuff from "white label" vendors (who most people will have never heard of); the models they like the best get D-Link branded and get a chance at shelf space around the world. The brands do have input into things like the web interface, enclosure design and/or setup procedures (e.g. WPS button). What the brands do is valuable, but they usually do not have deep insight into how the product actually works or how it's developed. The white-label vendors are like artists, trying to produce "hits", and the major brands are like record labels who can introduce things to a wide audience. Naturally, the brands try to find suppliers who can provide the best features at the lowest hardware cost. The software side is often not looked at very closely. When a researcher reports a vulnerability, this usually goes through the brand. Unfortunately, since they're not very technical, the brand tends to mangle the communications to the white-label. The white-label is scrambling to make their upstream customer (i.e. D-Link) happy, not the consumer. Communications problems are exacerbated when (as quite often happens) the firmware developer at the end of this chain does not have strong english. Finally, in the case where the firmware is riddled with such bugs, it's in the interest of the white-label to HIDE this fact from the brand. I think what needs to happen is that D-Link need to have high quality security reviews conducted as part of their vendor / hardware selection process. It's likely to happen, but it'll take years for the benefits to flow through to consumers. On the Telco side, most places are now putting their home gateways and so on through fairly rigorous security reviews during the selection and deployment process. The hardware vendors are slowly learning embedded security via that route. No-one likes to lose multi-million unit sales. [source: I've worked both in wifi router firmware development and pentesting, including embedded device security reviews].