NETGEAR Nighthawk AC1900 (R7000)

NETGEAR Nighthawk AC1900 (R7000)
Security Grade D Calculator v	NETGEAR Nighthawk AC1900 (R7000) Brand: NETGEAR Category: Router • Model / Gen: AC1900 Wi-Fi 5 R7000 (not R7000P) Release Date: 2013-10-01 • Status: Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	ASSESSOR INFERENCE: Rare denotes a local-possession barrier. Reset, power, Ethernet and USB permit physical modification or interruption; ordinary enclosure protection is not tamper-proof. No incident frequency is measured.
Known vulnerabilities	Very common	[1] [2] 🔗 Proof	ASSESSOR INFERENCE: Very common reflects recurring independent R7000 advisories over multiple years, including unauthenticated and post-authentication command injection. It is a historical vulnerability profile, not an infection rate or a claim that fixed 1.0.11.216 remains affected by all listed issues.
Prior attacks	Rare	🔗 Proof	ASSESSOR INFERENCE: Rare is a cautious campaign-history estimate. NETGEAR lists R7000 as potentially affected by VPNFilter but supplies no model infection count. The campaign is real; model-specific infection is not confirmed by this list.
Updatability	None	🔗 Proof	Vendor marks R7000 EoS with no future security updates planned; historical patches remain available.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Partial describes account-protected administration alongside DHCP/DNS, discovery and optional guest/ReadySHARE services. These do not universally authenticate peers; admin login is not universal mutual authentication.
Communications	No encryption	🔗 Proof	MANAGEMENT-CHANNEL SCOPE: the reviewed manual specifies HTTP local administration. No encryption denotes that weakest documented management path, not all radio traffic. WPA2-AES and some HTTPS services exist. The exact installed regional configuration is unknown.
Storage	No encryption	🔗 Proof	ASSESSOR INFERENCE, firmware-code flash scope: original stock R7000 firmware research analyses extractable images and executables. This supports readable firmware-code elements, not whole-flash confidentiality. It does not prove plaintext storage of all saved passwords or attached disks.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Administrator password management exists; full local role management was not demonstrated.
Authentication	Basic	🔗 Proof	Local password authentication exists; local MFA was not established.
Brute-force protection	Basic	🔗 Proof	ASSESSOR INFERENCE: Basic reflects the documented web-UI diversion after three incorrect logins into serial-number/security-question recovery; R7000 is in the applicability list. This is basic failed-login handling, not proof of a hard retry limit, delay, or resistance to direct automated requests.
Event logging	Partial logging	🔗 Proof	Router activity and security-event logs exist; complete administrator-access auditing is not established.
Passwords	Require change after setup	[3] 🔗 Proof	R7000-specific firmware instructions identify the admin password as the one specified at first login. This supports setup-created credentials; mandatory mixed-character complexity is not established. Historical factory defaults and physical reset risk are separate limitations.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	NETGEAR stock firmware; fixed reference 1.0.11.216; installed build unknown. (Companion App: Nighthawk app)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Dual-band Wi-Fi; Gigabit Ethernet
Physical (Dimensions & Mass)	Dimensions: • Mass:

Research assessment reviewed 2026-10-22. This grade is an assessor risk profile based on the stated evidence and inferences, not a test or certification of an individual installed device.

Assessment scope and limits

Original R7000, not R7000P. Vendor fixed-version reference 1.0.11.216, June 2026; not a latest-installed-build claim. The 2019 manual cannot establish current firmware defaults.

Historical vulnerability evidence, current documented capabilities and assessor inferences are identified separately in the comments. Historical-build findings are not asserted in every patched build. Configuration-dependent benefits apply only when the specified settings are enabled. The rubric does not define numerical Rare/Very common thresholds; qualitative mappings are explained.

Release date is the vendor 1 October 2013 launch/availability release reproduced by MyOpenRouter. The June 2026 vendor advisory reports no future security updates; a retail end-of-sale date is not inferred. Vendor R7000 launch release, republished by MyOpenRouter NETGEAR June 2026 advisory

Calculation cross-check

Device CRIS 2, 3, 2, 3, CATS 3. System CRIS 2, 3, 3, CATS 3. User Authentication CRIS 2, 2, 2, 2, 2, CATS 2. GRAS 8; expected Grade D. Methodology

Historical vulnerabilities and remediation

CVE-2016-6277: Unauthenticated command injection

• Affected scope: R7000 explicitly listed; complete affected-build interval not supplied.

• Preconditions: Reachable vulnerable management service; no prior login for the reported flaw.

• Impact: Arbitrary system commands.

• Remediation: NETGEAR confirms production fixes; first fixed R7000 build not established here.

• Severity: Numeric score not independently verified; omitted.

• Evidence: NETGEAR CVE-2016-6277

CVE-2026-0410: Insufficient input validation

• Affected scope: R7000 is listed with fixed reference 1.0.11.216; lower affected bound unspecified.

• Preconditions: Authenticated administrator on the local network.

• Impact: Elevated access or unauthorized software/functionality changes.

• Remediation: R7000 1.0.11.216, vendor table.

• Severity: Vendor qualitative severity Low; numeric score omitted.

• Evidence: NETGEAR June 2026 advisory