NETGEAR Nighthawk AC1900 (R7000)

NETGEAR Nighthawk AC1900 (R7000)
Security Grade D Calculator v1	NETGEAR Nighthawk AC1900 (R7000) Brand: NETGEAR Category: Router • Model / Gen: AC1900 Wi-Fi 5 R7000 (not R7000P) Release Date: 2013-10-01 • Status: Classification Date: 2026-10-27 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	ASSESSOR INFERENCE: Rare denotes a local-possession barrier. Reset, power, Ethernet and USB permit physical modification or interruption; ordinary enclosure protection is not tamper-proof. No incident frequency is measured.
Known vulnerabilities	Very common	[1] [2] 🔗 Proof	ASSESSOR INFERENCE: Very common reflects recurring independent R7000 advisories over multiple years, including unauthenticated and post-authentication command injection. It is a historical vulnerability profile, not an infection rate or a claim that fixed 1.0.11.216 remains affected by all listed issues.
Prior attacks	Rare	🔗 Proof	ASSESSOR INFERENCE: Rare is a cautious campaign-history estimate. NETGEAR lists R7000 as potentially affected by VPNFilter but supplies no model infection count. The campaign is real; model-specific infection is not confirmed by this list.
Updatability	None	🔗 Proof	Vendor marks R7000 EoS with no future security updates planned; historical patches remain available.
Category Score	Score: 3 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Partial describes account-protected administration alongside DHCP/DNS, discovery and optional guest/ReadySHARE services. These do not universally authenticate peers; admin login is not universal mutual authentication.
Communications	No encryption	🔗 Proof	MANAGEMENT-CHANNEL SCOPE: the reviewed manual specifies HTTP local administration. No encryption denotes that weakest documented management path, not all radio traffic. WPA2-AES and some HTTPS services exist. The exact installed regional configuration is unknown.
Storage	No encryption	[3] 🔗 Proof	Published work extracts a downloaded R7000 1.0.9.64 image. This does not establish at-rest flash encryption on 1.0.11.216. The storage score remains provisional.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Administrator password management exists; full local role management was not demonstrated.
Authentication	Basic	🔗 Proof	Local password authentication exists; local MFA was not established.
Brute-force protection	Basic	[4] [5] 🔗 Proof	WPS PIN attempts have temporary lockout. R7000 lacks the separate Armor Brute Force Protection feature. Web-admin login throttling on 1.0.11.216 remains unverified; the Basic score is provisional.
Event logging	Partial logging	🔗 Proof	Router activity and security-event logs exist; complete administrator-access auditing is not established.
Passwords	Require change after setup	[6] 🔗 Proof	R7000-specific firmware instructions identify the admin password as the one specified at first login. This supports setup-created credentials; mandatory mixed-character complexity is not established. Historical factory defaults and physical reset risk are separate limitations.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	NETGEAR stock firmware; fixed reference 1.0.11.216; installed build unknown. (Companion App: Nighthawk app)
Hardware (CPU / GPU)	CPU: 1 GHz dual-core processor • GPU:
Memory & Storage	Memory: 256 MB RAM • Storage: 128 MB flash; external USB storage supported
Power, Battery & Charging	Battery: • Power: DC adapter output 12 V, 3.5 A; AC input varies by region • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: 2.4/5 GHz Wi-Fi 5 AC1900; 1 Gigabit WAN + 4 Gigabit LAN; 1 USB 3.0 + 1 USB 2.0
Physical (Dimensions & Mass)	Dimensions: • Mass:

Evidence review addendum — 2026-10-24. Public-document review; ratings with evidence gaps remain provisional.

This addendum supersedes earlier inconsistent wording on the same fields. It is based on public documents and the saved website snapshot; no installed device was tested. Historical research below remains historical evidence. Unverified flash protection and interface-specific controls are not verified device facts.

Documented basic information

• 销售/生命周期: End of support (R7000 marked EoS in NETGEAR June 2026 advisory; no further security updates planned) Source
• CPU: 1 GHz dual-core processor Source
• 内存: 256 MB RAM Source
• 存储: 128 MB flash; external USB storage supported Source
• 电源: DC adapter output 12 V, 3.5 A; AC input varies by region Source
• 官网: https://www.netgear.com/no/home/wifi/routers/r7000/ Source Source
• 连接方式: 2.4/5 GHz Wi-Fi 5 AC1900; 1 Gigabit WAN + 4 Gigabit LAN; 1 USB 3.0 + 1 USB 2.0 Source

Revised security evidence notes

• 闪存存储加密: Published work extracts a downloaded R7000 1.0.9.64 image. This does not establish at-rest flash encryption on 1.0.11.216. The storage score remains provisional. Source Source
• 防暴力破解: WPS PIN attempts have temporary lockout. R7000 lacks the separate Armor Brute Force Protection feature. Web-admin login throttling on 1.0.11.216 remains unverified; the Basic score is provisional. Source Source Source

Scoring status

Existing selected scores are a saved comparison baseline, not newly validated final scores. Recheck version, region and assessment path before updating options. Recalculate CATS/GRAS and synchronize this section after all selected options are settled. Do not infer a secure or insecure flash state from a downloadable firmware image or encrypted data volumes.

---

Research assessment reviewed 2026-10-22. This grade is an assessor risk profile based on the stated evidence and inferences, not a test or certification of an individual installed device.

Assessment scope and limits

Original R7000, not R7000P. Vendor fixed-version reference 1.0.11.216, June 2026; not a latest-installed-build claim. The 2019 manual cannot establish current firmware defaults.

Historical vulnerability evidence, current documented capabilities and assessor inferences are identified separately in the comments. Historical-build findings are not asserted in every patched build. Configuration-dependent benefits apply only when the specified settings are enabled. The rubric does not define numerical Rare/Very common thresholds; qualitative mappings are explained.

Release date is the vendor 1 October 2013 launch/availability release reproduced by MyOpenRouter. The June 2026 vendor advisory reports no future security updates; a retail end-of-sale date is not inferred. Vendor R7000 launch release, republished by MyOpenRouter NETGEAR June 2026 advisory

Calculation cross-check

Device CRIS 2, 3, 2, 3, CATS 3. System CRIS 2, 3, 3, CATS 3. User Authentication CRIS 2, 2, 2, 2, 2, CATS 2. GRAS 8; expected Grade D. Methodology

Historical vulnerabilities and remediation

CVE-2016-6277: Unauthenticated command injection

• Affected scope: R7000 explicitly listed; complete affected-build interval not supplied.

• Preconditions: Reachable vulnerable management service; no prior login for the reported flaw.

• Impact: Arbitrary system commands.

• Remediation: NETGEAR confirms production fixes; first fixed R7000 build not established here.

• Severity: Numeric score not independently verified; omitted.

• Evidence: NETGEAR CVE-2016-6277

CVE-2026-0410: Insufficient input validation

• Affected scope: R7000 is listed with fixed reference 1.0.11.216; lower affected bound unspecified.

• Preconditions: Authenticated administrator on the local network.

• Impact: Elevated access or unauthorized software/functionality changes.

• Remediation: R7000 1.0.11.216, vendor table.

• Severity: Vendor qualitative severity Low; numeric score omitted.

• Evidence: NETGEAR June 2026 advisory