Netgear Nighthawk AX12 (RAX120) Router

```

Device Name	Netgear Nighthawk AX12 (RAX120) Router
Brand	Netgear
Type	High-Performance Home / Gaming Router
Released	2019
Current Firmware	End of Service (no further updates planned)

Device Category

Criterion	Score	Justification
Known hardware tampering	2 (Rare)	Router has basic physical security. Exposed UART ports on PCB allow firmware extraction with specialized tools. No tamper detection feature. CVE-2026-62656 Technical Details
Known vulnerabilities	3 (Very common)	Multiple critical CVEs documented including post-authentication command injection (CVE-2026-62656), TLS certificate validation flaw allowing MITM attacks (CVE-2026-0420), and missing authentication for critical functions. CVE-2026-0420, Netgear Security Advisory
Prior attacks	2 (Rare)	Netgear routers have been targeted by Mirai variants and other botnets, but the high-end Nighthawk line is less frequently compromised than low-cost models due to default password requirements. Mirai Botnet Target Analysis
Updatability	3 (None)	Netgear has officially marked RAX120 as "End of Service" — no further firmware updates planned. All known vulnerabilities will remain unpatched on devices still in use. RAX120 Product Page

Device Category Score: 3

System Category

Criterion	Score	Justification
Authentication with other systems	2 (Partial)	Web management interface requires password authentication, but remote management (DRS) is often enabled by default and exposed to the internet without proper protection. Netgear Security Notice
Communications	2 (Encrypted with obsolete encryption)	HTTPS is supported but TLS certificate validation is flawed — CVE-2026-0420 allows man-in-the-middle attacks due to improper certificate checking in the ReadyCloud client. CVE-2026-0420 MITM Vulnerability
Storage	3 (Not encrypted)	Configuration files, admin passwords, and Wi-Fi keys stored in flash memory without encryption. Physical access allows full credential extraction via UART. Router Firmware Extraction Research

System Category Score: 3

User Authentication Category

Criterion	Score	Justification
Account management	2 (Basic)	Single admin account only. No role-based access control or multi-user support. Guest network isolation is available but limited. Forescout Router Analysis
Authentication	2 (Basic)	Password-based web authentication only. No two-factor authentication support. Some firmware versions have hardcoded backdoor credentials in legacy code. Router Backdoor Research
Brute-force protection	2 (Basic)	Basic rate limiting exists for web login, but Telnet and SSH services have minimal protection. Many older firmware versions have no account lockout. CNCERT Brute-force Report
Event logging	2 (Partial logging)	Basic system logs and security event logs are available, but do not record detailed admin action history or failed login attempts comprehensively. Bitdefender Logging Analysis
Passwords	2 (Require change after setup)	Users are forced to change default admin password during initial setup. Complexity requirements are moderate but not enforced strongly. Netgear Password Policy

User Authentication Category Score: 2

Final Grade

GRAS Total: 8

Final Grade: D (High Danger Level)

References

CVE-2026-62656 - Netgear Command Injection CVE-2026-0420 - Netgear TLS MITM Vulnerability Netgear RAX120 Official Support Page Forescout Riskiest Devices 2025 Bitdefender 2025 IoT Security Report ```

---

1. 1. 1. 设备 3：Samsung Smart TV (Tizen OS)