NETGEAR Nighthawk AC1900 (R7000)

From Wiki-IoT


Evidence review: 2026-10-21. Overall IDRS grade: not assigned.

All 12 criteria are investigated below. A documented capability, a historical vulnerability and an observed current configuration are different evidence types. Unresolved values are explicitly not scored; absence of a public report is not evidence of absence.

Classification form fields are stored in this page. The evidence table is displayed while required ratings remain unresolved, so no overall grade is assigned. Blank rating choices mean insufficient evidence, not None or Absent.

Product information

Field Verified value / stated scope
Name NETGEAR Nighthawk AC1900 Smart WiFi Router
Brand NETGEAR
Model R7000 (not R7000P)
Generation AC1900 Wi-Fi 5
Operating System NETGEAR stock firmware; fixed reference 1.0.11.216; installed build unknown.
Connectivity Dual-band Wi-Fi; Gigabit Ethernet
Companion App Nighthawk app
Type Router
Website https://kb.netgear.com/000070811/June-2026-NETGEAR-Security-Advisory
Status End of security support: no future security updates planned, June 2026 vendor advisory

Assessment scope

Original R7000, not R7000P. Vendor fixed-version reference 1.0.11.216, June 2026; not a latest-installed-build claim. The 2019 manual cannot establish current firmware defaults.

No physical device, installed firmware, password, network trace or storage image was inspected. Conditional capability assessments apply only when the named settings are enabled.

Security evaluation

Device

Criterion Finding / rubric choice Evidence and reasoning
Known hardware tampering Physical exposure documented; not rated The R7000 guide documents reset, power, Ethernet and USB access. A physical-resistance test and model-specific tampering incidence were not established. R7000 user manual, January 2019
Known vulnerabilities Confirmed vulnerabilities; frequency not quantified The records below establish historical vulnerabilities within the stated firmware scope. They do not measure prevalence or establish a Rare/Very common frequency rating. NETGEAR CVE-2016-6277 NETGEAR June 2026 advisory
Prior attacks VPNFilter risk documented; rate unknown NETGEAR explicitly lists R7000 as potentially vulnerable in its VPNFilter advisory, citing Talos and law-enforcement observations. It does not state an R7000 infection count; potential vulnerability must not be presented as confirmed infection of every listed model. NETGEAR VPNFilter advisory
Updatability None (CRIS 3; scoped assessment) Vendor marks R7000 EoS with no future security updates planned; historical patches remain available. NETGEAR June 2026 advisory

System

Criterion Finding / rubric choice Evidence and reasoning
Authentication with other systems Not rated: insufficient evidence Local administration and cloud/app access are separate; universal mutual authentication was not established. R7000 user manual, January 2019
Communications Historical HTTP path documented; current scope unverified The January 2019 manual documents HTTP local administration and HTTPS for some remote-management use. This is historical firmware evidence; it does not establish that all channels on 1.0.11.216 are encrypted or plaintext. R7000 user manual, January 2019
Storage Not rated: insufficient evidence Encryption of configuration, credentials and attached storage at rest was not established. The methodology refers specifically to device flash, not just user disks, removable media, or encrypted network traffic. R7000 user manual, January 2019

User authentication

Criterion Finding / rubric choice Evidence and reasoning
Account management Basic (CRIS 2; scoped assessment) Administrator password management exists; full local role management was not demonstrated. R7000 user manual, January 2019
Authentication Basic (CRIS 2; scoped assessment) Local password authentication exists; local MFA was not established. R7000 user manual, January 2019
Brute-force protection Not rated: insufficient evidence Current firmware login-throttling and lockout thresholds were not verified. R7000 user manual, January 2019
Event logging Partial logging (CRIS 2; scoped assessment) Router activity and security-event logs exist; complete administrator-access auditing is not established. R7000 user manual, January 2019
Passwords Historical default credentials; current enforcement unverified The vendor VPNFilter advisory warns users to change the factory admin/password credentials. This confirms the historical default-password risk but does not establish mandatory first-login behavior of the June 2026 fixed build. NETGEAR VPNFilter advisory R7000 user manual, January 2019

Rating calculation

No definitive category score or GRAS is calculated while one or more required CRIS values are unresolved. The method requires taking the ceiling of each complete category mean and summing the three category scores. An unknown must not be substituted with 1 or treated as None. Wiki-IoT methodology

Historical vulnerabilities and remediation

CVE-2016-6277: Unauthenticated command injection

  • Affected scope: R7000 explicitly listed; complete affected-build interval not supplied.
  • Preconditions: Reachable vulnerable management service; no prior login for the reported flaw.
  • Impact: Arbitrary system commands.
  • Remediation: NETGEAR confirms production fixes; first fixed R7000 build not established here.
  • Severity: Numeric score not independently verified; omitted.

CVE-2026-0410: Insufficient input validation

  • Affected scope: R7000 is listed with fixed reference 1.0.11.216; lower affected bound unspecified.
  • Preconditions: Authenticated administrator on the local network.
  • Impact: Elevated access or unauthorized software/functionality changes.
  • Remediation: R7000 1.0.11.216, vendor table.
  • Severity: Vendor qualitative severity Low; numeric score omitted.

Product evidence notes

Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=NETGEAR_Nighthawk_AC1900_(R7000)&oldid=8668"