| NETGEAR Nighthawk AX5 (RAX43)
|
|
Security Grade
Calculator v
|
NETGEAR Nighthawk AX5 5-Stream AX4200 WiFi Router RAX43
Category: Wi-Fi router • Model / Gen: Original RAX43 hardware; Nighthawk AX5 / WiFi 6 series (not RAX43v2). RAX43 original hardware, not RAX43v2
Release Date: 2020-11-26 • Status: End of life
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Physical UART access with a fixed login yielded root privileges in the original research. Opening and wiring the device creates a practical physical attack path. Evidence boundary: Rare describes physical resistance, not a measured incident rate.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
The exact tested firmware has distinct authentication-bypass, command-injection, HTTP, fixed-UART-credential, backup-key and resident-password-storage findings. Evidence boundary: Several independent flaw classes justify3 under the declared operational interpretation; this is not a measured global vulnerability frequency.
|
| Prior attacks
|
None
|
🔗 Proof
|
Reviewed primary research documents laboratory exploitation; no exact-model in-the-wild campaign was established in this bounded review. Evidence boundary: None means no field campaign identified in reviewed sources, not proof of lifetime absence. The laboratory proof of concept is not counted as a field campaign. Additional primary evidence: source 2.
|
| Updatability
|
Rare
|
🔗 Proof
|
Official release notes provide security-fix images1.0.2.94 and 1.0.3.96. Installation is supported, but a regular pre-baseline maintenance cadence is not established. Evidence boundary: Score2 means documented updating with sparse or uncertain maintenance cadence.2025 Last Updated page timestamps are not firmware-release dates. Additional primary evidence: source 2; source 3; source 4.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
The documented WPA2 pre-shared-key wireless profile checks shared credentials, while HTTP management does not cryptographically authenticate the router to its browser client. Evidence boundary: Wireless link credentials do not establish full mutual authentication across every management and service path. Optional enterprise RADIUS/VPN policies are not assumed. Additional primary evidence: source 2; source 3.
|
| Communications
|
No encryption
|
🔗 Proof
|
The reported default HTTP management path carries sensitive information without application-layer encryption; WPA2 WiFi protects a separate link boundary. Evidence boundary: Score3 represents an enabled relevant plaintext application path, not a claim that all WiFi packets or every supported protocol lack encryption. Additional primary evidence: source 2.
|
| Storage
|
No encryption
|
🔗 Proof
|
The original researcher explicitly reports resident service credentials, including the administrator password in the primary device configuration, stored as plaintext. Evidence boundary: This concerns sensitive configuration resident on the device, not just an exported backup. It does not assert that the author read raw chips or proved every flash partition unencrypted.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
The documented local interface uses one named administrator with a changeable password and separate guest-network settings, rather than individual administrative roles. Evidence boundary: Basic describes the documented local administrator boundary; app/cloud identities and WiFi guests are separate from per-person local administrator accounts. Additional primary evidence: source 2.
|
| Authentication
|
Basic
|
🔗 Proof
|
UART requires credentials but accepts the common admin/admin login before granting root. Authentication exists, with a demonstrated fixed-secret weakness. Evidence boundary: This differs from R6700v3's unauthenticated UART. Do not label RAX43 authentication Absent merely because the fixed login is weak.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
The original RAX43 manual documents disabling the router PIN when suspicious WPS-PIN access attempts are detected, with manual re-enabling. This is partial failed-attempt protection. Evidence boundary: This credits WPS-PIN protection only. No exact retry threshold, fixed cooldown duration, or HTTP/UART login lockout is asserted. WPA3 offline-guessing resistance and optional Armor are not substituted for failed-authentication controls. Additional primary evidence: source 2.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The original manual documents local activity/security logs; the official family manual specifies up to 256 records. This supports partial logging, without complete identity-based access auditing. Evidence boundary: Partial logging does not claim a complete administrator-access audit or unlimited retention. Original 2020 manual printed p102 contains the logging section; the later family manual confirms the 256-entry feature. Additional primary evidence: source 2.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
The tested UART retains the common admin/admin credential even though web setup uses a chosen administrator password. The weakest administrative credential path determines this rating. Evidence boundary: This is a literal default/common-credential mapping. It does not call the owner's selected web password a factory default. Additional primary evidence: source 2; source 3.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
NETGEAR router firmware 1.0.3.96 (assessed historical build). (Companion App: NETGEAR Nighthawk app; browser-based router administration is also available.)
|
| Hardware (CPU / GPU)
|
CPU: 1.5 GHz triple-core processor; chip model not specified in the manufacturer data sheet. • GPU: Not publicly disclosed in cited manufacturer documentation.
|
| Memory & Storage
|
Memory: 512 MB RAM. • Storage: 256 MB internal flash; external storage can be attached through USB 3.0.
|
| Power, Battery & Charging
|
Battery: Not battery-operated; powered by an external DC adapter. • Power: External 12 V DC, 2.5 A adapter (30 W output rating, not measured consumption). • Charging: Not applicable to router operation; external DC power is required.
|
| Display & Camera
|
Display: Status LEDs; no graphical display specified. • Camera: Not applicable: no camera function specified for this router.
|
| Sound & Connectivity
|
Sound: Not applicable: no audio capture or playback function specified. • Connectivity: Dual-band WiFi 6 (2.4/5 GHz, AX4200); five Gigabit Ethernet ports (one WAN, four LAN); one USB 3.0 port.
|
| Physical (Dimensions & Mass)
|
Dimensions: 295.8 x 206 x 57.2 mm (manufacturer-listed dimension order). • Mass: 566 g (1.25 lb), router only.
|
Assessment scope
Documentation-based historical assessment of original RAX43 hardware with firmware 1.0.3.96, the exact version examined in Tenable TRA-2021-55 (published 30 December 2021). Use the normal commissioned WiFi/router profile with the documented web administrator password set; HTTP management and the reported common UART login remain within scope. The original NETGEAR September 2020 single-model manual (202-12140-01, preserved by ManualOwl) supports the contemporaneous WPS-PIN protection, logs and local management features. The 2023 official family manual is supplementary. No optional WPA3-only hardening, HTTPS-only policy or paid Armor subscription is credited. No physical installation or test was performed by the author.
Method and evidence boundaries
This is a documentary case-study assessment of the exact hardware, firmware and explicitly stated configuration, reviewed on 24 October 2026. No physical installation, penetration test or traffic capture by the author is claimed. Historical flaws do not establish current unpatched exposure. The website supplies qualitative categories rather than statistical thresholds: repeated real maintenance supports Updatability 1; isolated/uncertain maintenance supports2; a documented no-update condition supports3. Vulnerability/attack frequency labels are reasoned judgments, and a laboratory demonstration is not an observed campaign. None for prior attacks means no exact-model field campaign established in the reviewed sources, not proof of lifetime absence. Communications follows the least-protected enabled path carrying control, credentials or application payloads; a DNS/discovery packet alone is not used to label an entire device unencrypted. Storage evaluates confidential device-resident flash contents, not merely cloud security or whether executable firmware is readable. For Passwords, the methodology discusses first-setup credentials and expressly allows unique initial passwords. Where mandatory first-use creation or explicitly configured unique credentials do not match a shared-default-change label literally, option2 is a disclosed functional mapping, not a claim of forced periodic rotation. Option1 additionally requires enforced complexity; option3 requires positive evidence of common, predictable or unprotected access. Dates preserve the identified manufacturer announcement/availability or clearly identified primary regional catalog basis. No arbitrary first-of-month date is inserted. The calculated IDRS device grade is not a manufacturer certification or a student assignment mark.
Calculated IDRS: 2 + 3 + 3 = 8 (D).
Date basis: Digitec Switzerland original catalogue explicitly lists Date de sortie26/11/2020 for RAX43-100EUS. This is a documented regional retailer-listed release date; no claim of a manufacturer announcement or worldwide first-sale day is made.
Date source: https://www.digitec.ch/fr/s1/product/netgear-rax43-nighthawk-ax5-5-stream-ax4200-routeur-14378904
Product-specific boundaries: This assesses the exact historical firmware identified by original research; no claim is made that current firmware has the same flaws. The release date is the retailer's regional catalogue value for RAX43-100EUS, not a global first-sale assertion. Resident plaintext is supported by original research; no independent raw-chip test or assertion about every flash partition is made. The manufacturer-authored September 2020 manual is preserved on ManualOwl; the live official download is a January 2023 combined-model revision. WPS-PIN protection covers that interface only; comprehensive HTTP/UART rate limiting is not asserted.
Hardware and general-information supplement
Supplement reviewed on 25 October 2026. Manufacturer model specifications and explicitly identified historical manuals support the added fields. Hardware capabilities do not imply that optional services, accessories or every capacity variant are enabled in the assessed case. Unpublished or unverified parameters are identified rather than guessed. Current sale/support status is separate from the original historical firmware/configuration assessment; the twelve security selections and original evidence have not been changed.
Specification evidence
- Generation, Dimensions, Mass, CPU, GPU, Memory, Storage, Connectivity: source 1.
- Status: source 1.
- Operating system: source 1.
- Companion App, Camera, Sound: source 1; source 2.
- Battery, Power, Charging, Display: source 1.
Specification qualifications
- Specifications refer to original RAX43 hardware, not RAX43v2.
- The 30 W figure is the external adapter output rating, not a measurement of router consumption.
- Status End of life is a form-option mapping of NETGEAR End-of-Support (EoS) in the June/July 2026 advisories. No exact end-of-sale date is asserted. The security assessment remains the historical 1.0.3.96 case, not a current-firmware evaluation.
