Skip to main content
Link
Menu
Expand
(external link)
Document
Search
Copy
Copied
IoT autopsy
TP-Link Archer C7
Executive Summary
Scope
Technical Assessment
OSINT
Hardware Analysis
JTAG
UART
Boot & Runtime Analysis
Firmware Extraction
Automated Firmware Analysis
Manual Firmware Analysis
System Hardening Analysis
Web Interface Analysis
Universal Plug and Play Testing
USB Testing
Ethernet Testing
Wi-Fi Testing
Findings
HIGH-01 - Reversible root hash
HIGH-02 - Plaintext credentials in flash partition
HIGH-03 - Decryptable config backup file
MEDIUM-01 - Unauthenticated JTAG access
MEDIUM-02 - Readable and writable SPI flash
MEDIUM-03 - Accessible bootloader shell
MEDIUM-04 - Accessible root shell
MEDIUM-05 - Hardcoded DES-ECB key in firmware
MEDIUM-06 - Weak web interface credentials
MEDIUM-07 - Web interface lacks rate limiting
MEDIUM-08 - Identical WPS and WPA credentials
MEDIUM-09 - UPnP enabled by default
MEDIUM-10 - Unauthenticated access and excessive permissions to USB storage
MEDIUM-11 - Web interface served over HTTP
MEDIUM-12 - DoS via packet flooding
MEDIUM-13 - Capturable and crackable WPA handshake
LOW-01 - Accessible JTAG interface
LOW-02 - Accessible UART interface
LOW-03 - DDNS credentials stored in plaintext
INFO-01 - Hardware component CVEs
INFO-02 - Boot output discloses sentitive information
INFO-03 - Firmware image not encrypted
INFO-04 - Outdated Linux kernel
INFO-05 - Issues with shell scripts
INFO-06 - Binaries lacking protection mechanisms
INFO-07 - Use of weak functions in binaries
INFO-08 - Firmware CVEs
INFO-09 - All processes run as root
INFO-10 - Outdated BusyBox version
INFO-11 - Multiple superuser accounts
INFO-12 - Reversible dropbear hash
INFO-13 - Deprecated key exchange algorithms
INFO-14 - UPnP exposed on all interfaces
INFO-15 - Unidentified running service
INFO-16 - Debug kernel thread processes
INFO-17 - Web interface lacks password complexity requirements
INFO-18 - WPS enabled by default
INFO-19 - Insecure NAS authentication defaults
INFO-20 - Print server enabled by default
Appendix
OSINT artifacts
Hardware analysis artifacts
Boot and runtime analysis artifacts
Firmware extraction artifacts
CH341A programmer
UART and U-Boot
Firmware analysis artifacts
System hardening analysis artifacts
Web interface analysis artifacts
USB testing artifacts
Wi-Fi testing artifacts
TP-Link Tapo C210
Technical Assessment
OSINT
Hardware Analysis
UART
Findings
INFO-01 - Device CVEs
Appendix
Hardware analysis artifacts
Search IoT autopsy
TP-Link Archer C7
Appendix
Table of contents
OSINT artifacts
Hardware analysis artifacts
Boot and runtime analysis artifacts
Firmware extraction artifacts
Firmware analysis artifacts
System hardening analysis artifacts
Web interface analysis artifacts
USB testing artifacts
Wi-Fi testing artifacts