TP-Link Archer C2 / C20i

TP-Link Archer C2 / C20i
Security Grade D Calculator v1	TP-Link Archer C2 / C20i Brand: TP-Link Category: SOHO AC750 dual-band wireless router (802.11ac/n/a 5 GHz, n/g/b 2.4 GHz) • Model / Gen: Archer C2 / C20i (firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n documented as vulnerable) Release Date: 2014-02-01 • Status: End of life Classification Date: 2026-10-25 • [www.tp-link.com/en/home-networking/wifi-router/archer-c2/ Official Website]

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	[pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html 🔗 Proof]	Documentary assessment, NOT device testing. The opened independent advisory documents software weaknesses only; no physical-tampering mechanism or documented tampering campaign appears in opened sources.
Known vulnerabilities	Very common	[nvd.nist.gov/vuln/detail/CVE-2017-8218 🔗 Proof]	Documentary assessment, NOT device testing. Based on documented CVEs through firmware Build 160706 Rel.37961n: CVE-2017-8218 backdoor vsftpd accounts (admin/1234, guest/guest, test/test, CWE-1188), CVE-2017-8220 authenticated root RCE via shell metacharacters in the host= field (CWE-78, CVSS 9.9), CVE-2017-8219 httpd DoS via crafted Cookie (CWE-20), plus permissive default iptables (CVE-2017-8217) documented in the research advisory.
Prior attacks	Rare	[pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html 🔗 Proof]	Documentary assessment, NOT device testing. Public exploit detail and proof-of-concept requests were disclosed in the 2017 advisory; opened sources do not document a mass botnet or observed large-scale compromise campaign for this model, so compromise history is assessed Rare rather than Very common.
Updatability	Rare	[www.tp-link.com/en/support/download/archer-c2/v1/ 🔗 Proof]	Documentary assessment, NOT device testing. The official V1 download page shows a single security-oriented firmware (170207, published 2017-02-07, "Optimized the security mechanism") followed by no further updates; product page labels Archer C2 End of Life, so maintenance was limited and has ceased.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	No	[www.tp-link.com/en/home-networking/wifi-router/archer-c2/ 🔗 Proof]	Documentary assessment, NOT device testing. Official page documents local web management only; no cloud/SSO/external identity integration described.
Communications	No encryption	[pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html 🔗 Proof]	Documentary assessment, NOT device testing. The research advisory shows management performed over plain HTTP (192.168.1.1) with an HTTP Basic Cookie header (YWRtaW46YWRtaW4=) transmitted unencrypted.
Storage	No encryption	[pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html 🔗 Proof]	Documentary assessment, NOT device testing. The advisory documents the configuration as plaintext XML stored at offset 0x10 of MTD3, dumpable and modifiable after RCE, and the vsftpd_passwd file holding plaintext backdoor credentials; no encrypted-at-rest configuration documented.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	[nvd.nist.gov/vuln/detail/CVE-2017-8220 🔗 Proof]	Documentary assessment, NOT device testing. Only the built-in local admin account is used for the management interface; no multi-user or role management documented.
Authentication	Basic	[pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html 🔗 Proof]	Documentary assessment, NOT device testing. Web login relies on HTTP Basic over plain HTTP and is further undermined by hard-coded backdoor accounts in vsftpd; no MFA documented.
Brute-force protection	Absent	[pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html 🔗 Proof]	Documentary assessment, NOT device testing. The opened advisory and official materials describe no login lockout, throttling, or brute-force protection.
Event logging	Absent	[pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html 🔗 Proof]	Documentary assessment, NOT device testing. No authentication-event logging or audit trail is documented in the opened advisory or official product materials for this firmware.
Passwords	Default/Common/Easy to guess	[nvd.nist.gov/vuln/detail/CVE-2017-8218 🔗 Proof]	Documentary assessment, NOT device testing. CVE-2017-8218 documents hard-coded backdoor credentials admin/1234, guest/guest, test/test in vsftpd_passwd on firmware through Build 160706.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	proprietary Linux firmware (Linux 2.6.36 per independent research) (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: • Mass: