This topic

Smart Hub 2 firmware upgrade

roxburd — Wed, 08 Apr 2026 12:43:50 GMT

It's in the news today that Russians are targeting home Internet routers and the government advice is to ensure your hub firmware is up-to-date.

I can't see anywhere in my Smart Hub 2 console to check that the firmware is up-to-date. Have I missed it?

Assuming that the updates are self-managed, why not have an update option and, when clicked, advise the user that they are self-managed, rather than just leave the user hanging and searching around?

I do despair at BT - they claim to be all about security and then they go and make security more difficult and obscure than it needs to be.

Re: Smart Hub 2 firmware upgrade

imjolly — Wed, 08 Apr 2026 13:06:51 GMT

Hub firmware updates are automatic provided your hub is connected 24/7

As of April 2026, the current firmware version for the BT Smart Hub 2 (SH2) is v0.45.00.08028

Re: Smart Hub 2 firmware upgrade

chrisjp — Wed, 08 Apr 2026 13:04:29 GMT

I'm afraid you can't check for SH2 firmware updates yourself. They are rolled out by BT automatically when they are ready. If you go to your hub manager page (192.168.l.254) you'll see when its firmware was last updated.

Re: Smart Hub 2 firmware upgrade

roxburd — Wed, 08 Apr 2026 14:01:57 GMT

> As of April 2026, the current firmware version for the BT Smart Hub 2 (SH2) is v0.45.00.08028

I don't think it is - the firmware version on my hub is later than that (assuming a higher number means later).

I think that quite nicely proves my point - the Smart Hub 2 does not provide any way for the conscientious user to check that it is up-to-date.

Very poor.

Re: Smart Hub 2 firmware upgrade

barnpiece — Wed, 08 Apr 2026 14:08:53 GMT

Mine is v0.46.02.10311-BT.

Re: Smart Hub 2 firmware upgrade

licquorice — Wed, 08 Apr 2026 14:25:41 GMT

So @roxburd as it is not possible to manually update your firmware, what action would you take differently if you knew what the latest version was rather than as now?

Re: Smart Hub 2 firmware upgrade

WSH — Wed, 08 Apr 2026 15:08:09 GMT

Yes, it is v0.46.02.10311-BT.

I've been running that since the 12th of December, (and I'm usually late to get it).

There was posts about a later build version, 0.46.02.42261, but it seems to have caused problems so I think they pulled it.

Time-wise, we must be about due for a v47.

Re: Smart Hub 2 firmware upgrade

roxburd — Wed, 08 Apr 2026 15:08:19 GMT

> So @roxburd as it is not possible to manually update your firmware, what action would you take differently if you knew what the latest version was rather than as now?

If the unit was continually failing to get its required updates, @licquorice , it would be faulty. I would report it as faulty to BT and they would replace it. The new one would not be faulty and I would have a secure hub and a secure network.

Re: Smart Hub 2 firmware upgrade

WSH — Wed, 08 Apr 2026 15:24:29 GMT

A factory reset might jolt it back into updating.

Just be aware that a reset will drop the settings back to defaults and you will need to put any customisations in again. It is possible to export the configuration first, however, and then reimport it after.

Re: Smart Hub 2 firmware upgrade

roxburd — Wed, 08 Apr 2026 16:17:03 GMT

Where do I propose that BT publish their latest firmware version numbers, @licquorice ?

Erm. Well, Ubuntu publish their SHA hashes here: https://releases.ubuntu.com/26.04/SHA256SUMS

Ubuntu know a thing or two about security.

I believe that BT has web servers too. Even better, it could put them in their FAQs. And code their support bots up to provide the info. Or, since that is where the user will really want it, the hub itself could retrieve the info and present it to the user. There are many options.

Sadly, BT has taken the line "We know best - we update it. You silly user don't need to know." But not all their users are silly and some do want to know. BT's weak security approach has prevented us from keeping our systems secure.

From a cybersecurity perspective, the key thing is to provide the info over a secure channel, such as HTTPS (to prevent a man-in-the-middle attack). And to keep the server hosting the info secure (to prevent an at-rest modification/tampering attack).

This is all very old cyber 101. It is very sad that BT can't fulfil the simplest security requirements. Having worked for BT for 30 years, I know full-well why they are so incompetent - up until about the year 2000, they valued engineering above all. Then they started to value other things. "We are a people company", they said. Before then, they were a technology company with real technical competency. Now they are a people company, staffed by people who think the way to give great customer service is to apologise after it's all gone wrong.

Re: Smart Hub 2 firmware upgrade

gg30340 — Wed, 08 Apr 2026 17:04:03 GMT

@roxburdwrote:
Where do I propose that BT publish their latest firmware version numbers, @licquorice ?

Erm. Well, Ubuntu publish their SHA hashes here: https://releases.ubuntu.com/26.04/SHA256SUMS

Ubuntu know a thing or two about security.

I believe that BT has web servers too. Even better, it could put them in their FAQs. And code their support bots up to provide the info. Or, since that is where the user will really want it, the hub itself could retrieve the info and present it to the user. There are many options.

Sadly, BT has taken the line "We know best - we update it. You silly user don't need to know." But not all their users are silly and some do want to know. BT's weak security approach has prevented us from keeping our systems secure.

From a cybersecurity perspective, the key thing is to provide the info over a secure channel, such as HTTPS (to prevent a man-in-the-middle attack). And to keep the server hosting the info secure (to prevent an at-rest modification/tampering attack).

This is all very old cyber 101. It is very sad that BT can't fulfil the simplest security requirements. Having worked for BT for 30 years, I know full-well why they are so incompetent - up until about the year 2000, they valued engineering above all. Then they started to value other things. "We are a people company", they said. Before then, they were a technology company with real technical competency. Now they are a people company, staffed by people who think the way to give great customer service is to apologise after it's all gone wrong.

.... and yet you are still a BT customer!

Re: Smart Hub 2 firmware upgrade

WSH — Wed, 08 Apr 2026 18:07:00 GMT

If you’re referring to the article in today’s Guardian, I’ve just read it and I think it is more about the Cybersecurity Centre justifying it’s funding than anything else. To quote...

The expert said: “It’s not the first time that warnings have come out about routers. The main thing to say is that these so-called edge devices are quite often forgotten about, and they can become a weak point.”

Forgetting about them is what most ordinary users do. This is the reason why BT takes it completely out of the hands of the ordinary user and controls keeping it up to date themselves.

Re: Smart Hub 2 firmware upgrade

licquorice — Wed, 08 Apr 2026 18:10:36 GMT

Whilst I agree that the bean counters have taken over BT from the engineers, in this case they are right.

How many of BT's customer base do you think would

(a) Know where to look

(b) Know what they were looking at

Probably 10% at a very high estimate.

Comparing with a niche Linux distro is comparing apples and oranges.

The BT hub is a mass market device aimed at a plug and play audience that have absolutely no interest in how it works.

You are falling into the trap that techies make, thinking that everyone has the same interest as they do.

Anybody techie will know what to do, anybody non techie can just sit back and leave it to BT to update the hubs.

Re: Smart Hub 2 firmware upgrade

gg30340 — Wed, 08 Apr 2026 18:14:19 GMT

If it is that big an issue to you why don't you already have your own 3rd party router that you can tinker with as much as you want.

Re: Smart Hub 2 firmware upgrade

WSH — Wed, 08 Apr 2026 18:30:43 GMT

I will also add that the main protagonist referred to in that article has been very active in the IT security press for a long time now, so it's a bit late to be worrying about it. It looks as though the expert's comments were provoked by this article yesterday:

https://thehackernews.com/2026/04/russian-state-linked-apt28-exploits.html

Re: Smart Hub 2 firmware upgrade

roxburd — Wed, 08 Apr 2026 18:55:51 GMT

@WSH

> If you’re referring to the article in today’s Guardian, I’ve just read it and I think it is more about the Cybersecurity Centre justifying it’s funding than anything else.

Yup, who cares about Russian hackers getting into your home network and using it for building bot nets.

> This is the reason why BT takes it completely out of the hands of the ordinary user and controls keeping it up to date themselves.

I am very happy that BT has automated updates. Seriously, that's good. But conflating the updating mechanism with providing users the info they need to check that their hub is updated is not helpful.

@licquorice

Ubuntu is the most popular Linux distro - not a niche Linux distro. It's a niche interest but the biggest Linux distro.

Again, conflating the updating mechanism with providing users the info they need to check that their hub is updated is not helpful. Auto-update and update checking are not mutually exclusive. There is no reason the hub can't update itself AND provide users with assurance that it is up-to-date. It fails to do the latter.

> Anybody techie will know what to do

... er, except there is no mechanism to check and no explanation that there is no mechanism... so anybody techie can't know what to do. Because they can't do it.

@gg30340

> If it is that big an issue to you why don't you already have your own 3rd party router that you can tinker with as much as you want.

a) Because the BT one is free.
b) Because I didn't know this was an issue until this afternoon.
c) Because it's not that big an issue. Poor design, but now I know, I can dig around and probably figure out what the latest release is, even if BT fails to provide that info.

@WSH

It's a bit late to be updating your hub when APT28 has been active for some time? Do you leave your front door unlocked because people have been breaking into houses for some time now? Would you like to post your address, too?

Re: Smart Hub 2 firmware upgrade

WSH — Wed, 08 Apr 2026 19:23:52 GMT

That's not actually what I said.

I don't leave the door unlocked and I don't leave the router not updated. But I don't worry about them either. You have to keep these things in perspective or you'll worry yourself to death.

And as gg30340 said, get a different router if you want full control of it. The SH2 remains BT's property today, so why do you expect to have full control over it?

Edit: Actually, if you want to worry, I'd worry more about the ONT. I don't have any access to the control interface on that at all. And I've got to use that even if I use my own router.

Re: Smart Hub 2 firmware upgrade

licquorice — Wed, 08 Apr 2026 20:54:10 GMT

@roxburd I'm perfectly aware that Ubuntu is the largest Linux distro, I use it It is still niche compared to Microsoft and Apple.

My points still stand.

Re: Smart Hub 2 firmware upgrade

Kimberlin — Thu, 09 Apr 2026 06:13:24 GMT

@roxburd There are very many BT customers who are seemingly ‘happy’ with BT’s router offering because as has already been pointed out, the vast majority of the customer base has little interest or knowledge about how they work anyway. They are as you have also pointed out ‘free’, free that is until you have to return them to ensure you don’t get clobbered with the non return fee.

I have to agree with @gg30340 if you’re actually that bothered or interested in having much more control over your router, go out and buy your own. I don’t use any ISP router because I like to have far greater control over the equipment. I spent £300 on a third party router and I have far more control over it than any ISP router would ever give me and that’s my choice.

There are numerous settings within a decent 3 rd party router that will give you more control over security than BT’s SH2. The SH2 doesn’t for instance employ WPA3 encryption because it’s an 8 year old router that is lagging behind, but, for many, that isn’t an issue. You’re also forced to use BT’s own DNS resolvers because you can’t change them at router level, again, something that just doesn’t worry or feature in most customers minds and yet it should.

How many ISP customers have their ISP router SSID’s on show to the world indicating exactly what type of router is being employed? Almost all I bet. Most will be using the default router password, they won’t have disabled universal plug and play or WPS. There’s a whole host of options you can tinker with on a third party device.

Honestly, if you are genuinely concerned about your router security, go buy your own and forget about an article in a newspaper.

From a personal perspective, buying and using my own router is the best security I could employ, but then my priorities will be different to many others.

Re: Smart Hub 2 firmware upgrade

roxburd — Thu, 09 Apr 2026 07:08:52 GMT

@Kimberlin

I'm so grateful to the BT support community for suggesting that I run a non-BT router - I would never have thought of it!

I ran a Netgear router for about 10 years - from around 2010 to 2020 - because I wanted features that the BT hubs of the time did not offer. When that hub became obsolete and I no longer needed those features, I took a free BT hub.

But thanks for reminding me that I can do something that I have done, that's what anyone comes to these forums for - to be advised of the bleeding obvious.

On my current BT hub, I take regular precautions, such as changing the SSID, hiding it, and changing the default password. Plus some other stuff.

The only issue I had is NOT that it auto-updates - that is a good thing with no downside.

The only issue I had was that when the government advises you that state-sponsored hackers are currently exploiting out-of-date hubs and you should check yours is up-to-date, BT has made that important task very difficult to carry out. But I now know how poor BT's handling of this crucial task is and how to deal with it. So the issue is sorted. So I will keep the hub. Quite simple, really.

As for the argument that BT should ignore security because most customers aren't interested - we will have to agree to disagree on whether that is the right attitude for a responsible player in Britain's Critical National Infrastructure. Honestly, it's like suggesting that because Yale locks enjoys almost monopoly market status, it can afford to sell locks with poor security... except routers allows silent mass-attacks (bot-net attacks) from all over the world, not just unscalable physical break-ins. Cyber security is not like physical security - it can be scaled up to national-threat levels and carried out remotely. It is frankly bizarre to see people on this forum of all places saying that we should all just ignore it. Unless you're all Russians... Ah...