Skip to main content
Link
Menu
Expand
(external link)
Document
Search
Copy
Copied
IoT autopsy
TP-Link Archer C7
Executive Summary
Scope
Technical Assessment
OSINT
Hardware Analysis
JTAG
UART
Boot & Runtime Analysis
Firmware Extraction
Automated Firmware Analysis
Manual Firmware Analysis
System Hardening Analysis
Web Interface Analysis
Universal Plug and Play Testing
USB Testing
Ethernet Testing
Wi-Fi Testing
Findings
HIGH-01 - Reversible root hash
HIGH-02 - Plaintext credentials in flash partition
HIGH-03 - Decryptable config backup file
MEDIUM-01 - Unauthenticated JTAG access
MEDIUM-02 - Readable and writable SPI flash
MEDIUM-03 - Accessible bootloader shell
MEDIUM-04 - Accessible root shell
MEDIUM-05 - Hardcoded DES-ECB key in firmware
MEDIUM-06 - Weak web interface credentials
MEDIUM-07 - Web interface lacks rate limiting
MEDIUM-08 - Identical WPS and WPA credentials
MEDIUM-09 - UPnP enabled by default
MEDIUM-10 - Unauthenticated access and excessive permissions to USB storage
MEDIUM-11 - Web interface served over HTTP
MEDIUM-12 - DoS via packet flooding
MEDIUM-13 - Capturable and crackable WPA handshake
LOW-01 - Accessible JTAG interface
LOW-02 - Accessible UART interface
LOW-03 - DDNS credentials stored in plaintext
INFO-01 - Hardware component CVEs
INFO-02 - Boot output discloses sentitive information
INFO-03 - Firmware image not encrypted
INFO-04 - Outdated Linux kernel
INFO-05 - Issues with shell scripts
INFO-06 - Binaries lacking protection mechanisms
INFO-07 - Use of weak functions in binaries
INFO-08 - Firmware CVEs
INFO-09 - All processes run as root
INFO-10 - Outdated BusyBox version
INFO-11 - Multiple superuser accounts
INFO-12 - Reversible dropbear hash
INFO-13 - Deprecated key exchange algorithms
INFO-14 - UPnP exposed on all interfaces
INFO-15 - Unidentified running service
INFO-16 - Debug kernel thread processes
INFO-17 - Web interface lacks password complexity requirements
INFO-18 - WPS enabled by default
INFO-19 - Insecure NAS authentication defaults
INFO-20 - Print server enabled by default
Appendix
OSINT artifacts
Hardware analysis artifacts
Boot and runtime analysis artifacts
Firmware extraction artifacts
CH341A programmer
UART and U-Boot
Firmware analysis artifacts
System hardening analysis artifacts
Web interface analysis artifacts
USB testing artifacts
Wi-Fi testing artifacts
TP-Link Tapo C210
Technical Assessment
OSINT
Hardware Analysis
UART
Findings
INFO-01 - Device CVEs
Appendix
Hardware analysis artifacts
Search IoT autopsy
TP-Link Archer C7
Appendix
Hardware analysis artifacts
Wi-Fi SoC - QCA9558-AT4A
WLAN SoC - QCA9880-BBR4A
Ethernet switch - AR8327N-BL1A
RAM - A3R12E40CBF DDR2 SDRAM (x2)
Flash memory - S25FL127S
