Executive Summary
This document presents the findings of an embedded security assessment conducted against the TP-Link Archer C7 v2, a consumer dual band gigabit router. The assessment was performed on a device owned by the assessor, strictly for educational and research purposes.
The assessment combined black-box external testing with white-box internal analysis made possible through hardware interface access. All external and internal interfaces were assessed, including the web management interface, Wi-Fi, Ethernet, USB, UPnP, UART serial console, and JTAG debug interface.
The assessment identified a total of 39 findings across five severity levels. The highest severity findings, with high severity, are particularly notable: the root password hash is publicly available online and trivially recoverable, sensitive credentials including Wi-Fi PSK and WPS PIN are stored in plaintext in the config flash partition of the device firmware, and configuration backup files are decryptable using a hardcoded key that is publicly documented online. Among the medium severity findings, the most impactful include unauthenticated JTAG debug access enabling full CPU control and memory extraction, readable and writable firmware, and an accessible bootloader and root shells obtained via UART. The device exhibits a broad pattern of permissive default configurations, outdated software components, and insufficient credential protection, all of which are inconsistent with current security hardening best practices for production consumer devices.
Finding Summary
| Severity | Count |
|---|---|
| Critical | 0 |
| High | 3 |
| Medium | 13 |
| Low | 3 |
| Informational | 20 |
| Total | 39 |
Findings
| ID | Title | CVSS Score | Severity |
|---|---|---|---|
| HIGH-01 | Root hash publicly available and reversible | 7.5 | High |
| HIGH-02 | Sensitive plaintext credentials exposed in flash partition | 7.5 | High |
| HIGH-03 | Config backup file decryptable using publicly disclosed key | 7.5 | High |
| MEDIUM-01 | Unauthenticated JTAG debug access | 6.8 | Medium |
| MEDIUM-02 | Firmware readable and writable via SPI flash | 6.8 | Medium |
| MEDIUM-03 | Accessible bootloader shell | 6.8 | Medium |
| MEDIUM-04 | Accessible root shell | 6.8 | Medium |
| MEDIUM-05 | DES-ECB key hardcoded in firmware binary | 5.9 | Medium |
| MEDIUM-06 | Web interface weak default credentials | 6.5 | Medium |
| MEDIUM-07 | Web interface lacks rate limiting | 6.5 | Medium |
| MEDIUM-08 | Identical WPS and WPA default credentials | 6.5 | Medium |
| MEDIUM-09 | UPnP enabled by default | 6.5 | Medium |
| MEDIUM-10 | Unauthenticated access and permissions to USB storage | 5.4 | Medium |
| MEDIUM-11 | Web interface served over HTTP | 6.5 | Medium |
| MEDIUM-12 | Denial of service via packet flooding | 6.5 | Medium |
| MEDIUM-13 | WPA handshake capturable and susceptible to cracking | 6.5 | Medium |
| LOW-01 | Accessible JTAG interface | 2.4 | Low |
| LOW-02 | Accessible UART interface | 2.4 | Low |
| LOW-03 | DDNS credentials stored in plaintext | 3.7 | Low |
| INFO-01 | Hardware component CVEs | - | Informational |
| INFO-02 | Sensitive info disclosed via boot output | - | Informational |
| INFO-03 | Firmware image not encrypted | - | Informational |
| INFO-04 | Outdated Linux kernel | - | Informational |
| INFO-05 | Shell script issues | - | Informational |
| INFO-06 | Binaries lacking protection mechanisms | - | Informational |
| INFO-07 | Use of weak functions in binaries | - | Informational |
| INFO-08 | Firmware CVEs | - | Informational |
| INFO-09 | All processes run as root | - | Informational |
| INFO-10 | Outdated BusyBox version | - | Informational |
| INFO-11 | Multiple superuser accounts | - | Informational |
| INFO-12 | Reversible Dropbear hash | - | Informational |
| INFO-13 | Use of deprecated key exchange algorithms | - | Informational |
| INFO-14 | UPnP exposed on all interfaces | - | Informational |
| INFO-15 | Unidentified running service | - | Informational |
| INFO-16 | Presence of debug kernel thread processes | - | Informational |
| INFO-17 | Web interface lacks password complexity requirements | - | Informational |
| INFO-18 | WPS enabled by default | - | Informational |
| INFO-19 | Insecure NAS authentication defaults | - | Informational |
| INFO-20 | Print server feature enabled by default | - | Informational |