| TP-Link Archer C7 (V2)
|
|
Security Grade
Calculator v
|
TP-Link Archer C7 (V2)
Category: Router • Model / Gen: AC1750 Wi-Fi 5 Archer C7 hardware V2; regional variant must match firmware
Release Date: 2013-12-17 • Status: End of life
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
[1] 🔗 Proof
|
ASSESSOR INFERENCE: Rare denotes local-access requirements. Reset, power, USB and Ethernet allow a physically present person to alter or interrupt service. This is a design-based assessment, not measured tampering prevalence.
|
| Known vulnerabilities
|
Very common
|
[2] [3] 🔗 Proof
|
ASSESSOR INFERENCE: Very common denotes recurring historical fixes across classes: the reviewed credential-disclosure issue and V2 release notes addressing KRACK, traversal/XSS and memory-related issues. It is not a measured exploitation rate; affected and fixed regional firmware are distinguished.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
ASSESSOR INFERENCE: Rare is a cautious legacy-platform estimate from the vendor advisory citing exploitation reports. The source does not enumerate C7 V2 victims or establish a model-wide botnet population.
|
| Updatability
|
Rare
|
🔗 Proof
|
EOL product with exceptional manually installed patches; no cloud or automatic updates in this advisory scope.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Partial describes authenticated administration alongside DHCP/DNS, discovery and optional guest/USB-sharing access. Communication with other systems is not universally mutually authenticated.
|
| Communications
|
No encryption
|
🔗 Proof
|
Reviewed V2 management-channel scope: the manual specifies HTTP web administration and permits legacy Wi-Fi security as well as WPA2-AES. No encryption denotes the plaintext management path, not all radio traffic; current patched regional settings are unobserved.
|
| Storage
|
No encryption
|
[4] 🔗 Proof
|
ASSESSOR INFERENCE, boot/firmware-code scope: stock recovery documentation describes ordinary flash partitions and publicly transferable recovery images. This supports a limited readable boot-code assessment, not proof that all saved credentials are plaintext. Security properties of third-party OpenWrt are not attributed to stock firmware.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Administrator credentials can be changed; full local role management was not demonstrated.
|
| Authentication
|
Basic
|
🔗 Proof
|
Local username/password login is documented; stronger local factors were not established.
|
| Brute-force protection
|
Basic
|
[5] 🔗 Proof
|
Conditional Basic assessment: the vendor brute-force FAQ includes Archer C7 and describes temporary web-login blocking after too many failed attempts. It does not identify an exact V2 build/timer; applicability to updated V2 stock firmware is an inference, not a guarantee for every old build.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
System Log exists; comprehensive access-event auditing is not established.
|
| Passwords
|
Require change after setup
|
[6] 🔗 Proof
|
TP-Link staff describes newer C7 V2 firmware requiring a user-created setup password instead of common admin credentials. This maps to the setup-password bucket; enforced mixed-character complexity on the reviewed regional patch is not established.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
TP-Link stock firmware; EU V2 241108 or US V2 260427 are regional fix references. (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity:
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Research assessment reviewed 2026-10-22. This grade is an assessor risk profile based on the stated evidence and inferences, not a test or certification of an individual installed device.
Assessment scope and limits
Hardware V2, stock firmware. Match country: advisory fix references EU_V2_241108 and US_V2_260427. No cross-region installation assumed; US V2 manual is historical evidence.
Historical vulnerability evidence, current documented capabilities and assessor inferences are identified separately in the comments. Historical-build findings are not asserted in every patched build. Configuration-dependent benefits apply only when the specified settings are enabled. The rubric does not define numerical Rare/Very common thresholds; qualitative mappings are explained.
DATE PROXY approved for this review: 17 December 2013 is the vendor-listed first Archer C7 V2 firmware publication (131217), not a verified regional first-sale date. Archer C7 V2 first firmware publication
Calculation cross-check
Device CRIS 2, 3, 2, 2, CATS 3. System CRIS 2, 3, 3, CATS 3. User Authentication CRIS 2, 2, 2, 2, 2, CATS 2. GRAS 8; expected Grade D. Methodology
Historical vulnerabilities and remediation
CVE-2023-50224: Improper authentication / credential disclosure
- Affected scope: Vendor explicitly includes Archer C7 V2/V3; earliest affected builds unspecified.
- Preconditions: Network-adjacent access to vulnerable httpd.
- Impact: Sensitive information disclosure, including stored credentials.
- Remediation: EU V2 241108; US V2 260427. Match region and hardware.
- Severity: Numeric score not independently verified; omitted.
