You do not have permission to edit this page, for the following reasons:
'''Evidence review addendum — 2026-10-24. Public-document review; ratings with evidence gaps remain provisional.''' This addendum supersedes earlier inconsistent wording on the same fields. It is based on public documents and the saved website snapshot; no installed device was tested. Historical research below remains historical evidence. Unverified flash protection and interface-specific controls are not verified device facts. == Documented basic information == * 销售/生命周期: End of support (R7000 marked EoS in NETGEAR June 2026 advisory; no further security updates planned) [https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory Source] * CPU: 1 GHz dual-core processor [https://www.netgear.com/no/home/wifi/routers/r7000/ Source] * 内存: 256 MB RAM [https://www.netgear.com/no/home/wifi/routers/r7000/ Source] * 存储: 128 MB flash; external USB storage supported [https://www.netgear.com/no/home/wifi/routers/r7000/ Source] * 电源: DC adapter output 12 V, 3.5 A; AC input varies by region [https://www.downloads.netgear.com/files/GDC/R7000/R7000_UM.pdf Source] * 官网: https://www.netgear.com/no/home/wifi/routers/r7000/ [https://www.netgear.com/no/home/wifi/routers/r7000/ Source] [https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory Source] * 连接方式: 2.4/5 GHz Wi-Fi 5 AC1900; 1 Gigabit WAN + 4 Gigabit LAN; 1 USB 3.0 + 1 USB 2.0 [https://www.netgear.com/no/home/wifi/routers/r7000/ Source] == Revised security evidence notes == * 闪存存储加密: Published work extracts a downloaded R7000 1.0.9.64 image. This does not establish at-rest flash encryption on 1.0.11.216. The storage score remains provisional. [https://samy.pl/slipstream/ Source] [https://iot-lab-fh-ooe.github.io/netgear_update_vulnerability/ Source] * 防暴力破解: WPS PIN attempts have temporary lockout. R7000 lacks the separate Armor Brute Force Protection feature. Web-admin login throttling on 1.0.11.216 remains unverified; the Basic score is provisional. [https://www.downloads.netgear.com/files/GDC/R7000/R7000_UM.pdf Source] [https://kb.netgear.com/000063814/Which-Armor-features-are-not-supported-by-some-legacy-NETGEAR-devices Source] [https://kb.netgear.com/19824/How-do-NETGEAR-Home-routers-defend-WiFi-Protected-Setup-PIN-against-brute-force-vulnerability Source] == Scoring status == Existing selected scores are a saved comparison baseline, not newly validated final scores. Recheck version, region and assessment path before updating options. Recalculate CATS/GRAS and synchronize this section after all selected options are settled. Do not infer a secure or insecure flash state from a downloadable firmware image or encrypted data volumes. ---- '''Research assessment reviewed 2026-10-22. This grade is an assessor risk profile based on the stated evidence and inferences, not a test or certification of an individual installed device.''' == Assessment scope and limits == Original R7000, not R7000P. Vendor fixed-version reference 1.0.11.216, June 2026; not a latest-installed-build claim. The 2019 manual cannot establish current firmware defaults. Historical vulnerability evidence, current documented capabilities and assessor inferences are identified separately in the comments. Historical-build findings are not asserted in every patched build. Configuration-dependent benefits apply only when the specified settings are enabled. The rubric does not define numerical Rare/Very common thresholds; qualitative mappings are explained. Release date is the vendor 1 October 2013 launch/availability release reproduced by MyOpenRouter. The June 2026 vendor advisory reports no future security updates; a retail end-of-sale date is not inferred. [https://myopenrouter.com/blog/netgear-dominates-wi-fi-performance-new-r7000-nighthawk-80211ac-wifi-router/ Vendor R7000 launch release, republished by MyOpenRouter] [https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory NETGEAR June 2026 advisory] == Calculation cross-check == Device CRIS 2, 3, 2, 3, CATS 3. System CRIS 2, 3, 3, CATS 3. User Authentication CRIS 2, 2, 2, 2, 2, CATS 2. GRAS 8; expected Grade D. [https://fehmijaafar.net/wiki-iot/index.php/Methodology Methodology] == Historical vulnerabilities and remediation == === CVE-2016-6277: Unauthenticated command injection === * Affected scope: R7000 explicitly listed; complete affected-build interval not supplied. * Preconditions: Reachable vulnerable management service; no prior login for the reported flaw. * Impact: Arbitrary system commands. * Remediation: NETGEAR confirms production fixes; first fixed R7000 build not established here. * Severity: Numeric score not independently verified; omitted. * Evidence: [https://kb.netgear.com/000036386/ NETGEAR CVE-2016-6277] === CVE-2026-0410: Insufficient input validation === * Affected scope: R7000 is listed with fixed reference 1.0.11.216; lower affected bound unspecified. * Preconditions: Authenticated administrator on the local network. * Impact: Elevated access or unauthorized software/functionality changes. * Remediation: R7000 1.0.11.216, vendor table. * Severity: Vendor qualitative severity Low; numeric score omitted. * Evidence: [https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory NETGEAR June 2026 advisory]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
