(
diff)
← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| TP-Link Archer C7 (V2)
|
|
Security Grade
Calculator v1
|
TP-Link Archer C7 (V2)
Category: Router • Model / Gen: AC1750 Wi-Fi 5 Archer C7 hardware V2; regional variant must match firmware
Release Date: 2013-12-17 • Status: End of life
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
[1] 🔗 Proof
|
ASSESSOR INFERENCE: Rare denotes local-access requirements. Reset, power, USB and Ethernet allow a physically present person to alter or interrupt service. This is a design-based assessment, not measured tampering prevalence.
|
| Known vulnerabilities
|
Very common
|
[2] [3] 🔗 Proof
|
ASSESSOR INFERENCE: Very common denotes recurring historical fixes across classes: the reviewed credential-disclosure issue and V2 release notes addressing KRACK, traversal/XSS and memory-related issues. It is not a measured exploitation rate; affected and fixed regional firmware are distinguished.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
ASSESSOR INFERENCE: Rare is a cautious legacy-platform estimate from the vendor advisory citing exploitation reports. The source does not enumerate C7 V2 victims or establish a model-wide botnet population.
|
| Updatability
|
Rare
|
🔗 Proof
|
EOL product with exceptional manually installed patches; no cloud or automatic updates in this advisory scope.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Partial describes authenticated administration alongside DHCP/DNS, discovery and optional guest/USB-sharing access. Communication with other systems is not universally mutually authenticated.
|
| Communications
|
No encryption
|
🔗 Proof
|
Reviewed V2 management-channel scope: the manual specifies HTTP web administration and permits legacy Wi-Fi security as well as WPA2-AES. No encryption denotes the plaintext management path, not all radio traffic; current patched regional settings are unobserved.
|
| Storage
|
No encryption
|
[4] 🔗 Proof
|
A 2017 thesis documents an Archer C7 V2 sample and U-Boot layout. It does not establish at-rest encryption of current regional stock firmware. The storage score is provisional.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Administrator credentials can be changed; full local role management was not demonstrated.
|
| Authentication
|
Basic
|
🔗 Proof
|
Local username/password login is documented; stronger local factors were not established.
|
| Brute-force protection
|
Basic
|
[5] [6] 🔗 Proof
|
TP-Link describes temporary blocking after repeated login errors in general guidance. Applicability to Archer C7 V2 EU 241108 or US 260427 has not been verified.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
System Log exists; comprehensive access-event auditing is not established.
|
| Passwords
|
Require change after setup
|
[7] [8] 🔗 Proof
|
In a V2 thread identifying firmware 180305, TP-Link support says initial setup requires creating a password and rejects admin as that password. The selected later regional builds remain unverified.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
TP-Link stock firmware; EU V2 241108 or US V2 260427 are regional fix references. (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: DC 12 V, 2.5 A (official V2 RU datasheet; check regional adapter label) • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: 2.4/5 GHz Wi-Fi AC1750; 1 Gigabit WAN + 4 Gigabit LAN; 2 USB 2.0
|
| Physical (Dimensions & Mass)
|
Dimensions: 243 × 160.6 × 32.5 mm (W×D×H; official V2 RU datasheet) • Mass:
|
Evidence review addendum — 2026-10-24. Public-document review; ratings with evidence gaps remain provisional.
This addendum supersedes earlier inconsistent wording on the same fields. It is based on public documents and the saved website snapshot; no installed device was tested. Historical research below remains historical evidence. Unverified flash protection and interface-specific controls are not verified device facts.
Documented basic information
- 尺寸: 243 × 160.6 × 32.5 mm (W×D×H; official V2 RU datasheet) Source
- 电源: DC 12 V, 2.5 A (official V2 RU datasheet; check regional adapter label) Source Source
- 连接方式: 2.4/5 GHz Wi-Fi AC1750; 1 Gigabit WAN + 4 Gigabit LAN; 2 USB 2.0 Source Source
Revised security evidence notes
- 闪存存储加密: A 2017 thesis documents an Archer C7 V2 sample and U-Boot layout. It does not establish at-rest encryption of current regional stock firmware. The storage score is provisional. Source Source
- 防暴力破解: TP-Link describes temporary blocking after repeated login errors in general guidance. Applicability to Archer C7 V2 EU 241108 or US 260427 has not been verified. Source Source Source
- 密码规则: In a V2 thread identifying firmware 180305, TP-Link support says initial setup requires creating a password and rejects admin as that password. The selected later regional builds remain unverified. Source Source Source
Scoring status
Existing selected scores are a saved comparison baseline, not newly validated final scores. Recheck version, region and assessment path before updating options. Recalculate CATS/GRAS and synchronize this section after all selected options are settled. Do not infer a secure or insecure flash state from a downloadable firmware image or encrypted data volumes.
Research assessment reviewed 2026-10-22. This grade is an assessor risk profile based on the stated evidence and inferences, not a test or certification of an individual installed device.
Assessment scope and limits
Hardware V2, stock firmware. Match country: advisory fix references EU_V2_241108 and US_V2_260427. No cross-region installation assumed; US V2 manual is historical evidence.
Historical vulnerability evidence, current documented capabilities and assessor inferences are identified separately in the comments. Historical-build findings are not asserted in every patched build. Configuration-dependent benefits apply only when the specified settings are enabled. The rubric does not define numerical Rare/Very common thresholds; qualitative mappings are explained.
DATE PROXY approved for this review: 17 December 2013 is the vendor-listed first Archer C7 V2 firmware publication (131217), not a verified regional first-sale date. Archer C7 V2 first firmware publication
Calculation cross-check
Device CRIS 2, 3, 2, 2, CATS 3. System CRIS 2, 3, 3, CATS 3. User Authentication CRIS 2, 2, 2, 2, 2, CATS 2. GRAS 8; expected Grade D. Methodology
Historical vulnerabilities and remediation
CVE-2023-50224: Improper authentication / credential disclosure
- Affected scope: Vendor explicitly includes Archer C7 V2/V3; earliest affected builds unspecified.
- Preconditions: Network-adjacent access to vulnerable httpd.
- Impact: Sensitive information disclosure, including stored credentials.
- Remediation: EU V2 241108; US V2 260427. Match region and hardware.
- Severity: Numeric score not independently verified; omitted.
