Teltonika TCR100 (TCR100)

Documentation-based security assessment — pending evidence completion and administrator review. No overall grade is assigned.

Device

• Product: Teltonika TCR100
• Brand: Teltonika
• Model: TCR100
• Type: Router
• Operating system: RutOS
• Website: Official model documentation
• Exact commercial release date: unverified

Device security

Criterion	Assessment	Evidence	Comment
Known hardware tampering	Unscored	Source	Malicious hardware-tampering frequency has not been established. Documented recovery mechanisms are not measurements of attack incidence.
Known vulnerabilities	Very common	Source	The model firmware history lists multiple CVE patches. This concerns historical vulnerability exposure; it does not mean patched firmware remains affected.
Prior attacks	Unscored	Source	Model-specific real-world exploitation frequency has not been established. Security advisories and patches alone do not demonstrate attacks.
Updatability	Rare	Source	TCR1_R_00.07.14.5 (2026-04-15) is listed. Recent updates are sparse and the model is in EOL transition; support has not yet ended. Availability does not prove installation.

System security

Criterion	Assessment	Evidence	Comment
Authentication with other systems	Partial	Source	Certificate-based services are configurable. Universal mutual authentication across all interfaces is not established.
Communications	Plain HTTP possible in documented defaults	Source	HTTP and HTTPS access default on, while HTTPS redirection defaults off. Scope: management defaults, not a claim that all traffic is plaintext.
Storage encryption	Unscored	Source	Encryption of exported archives is documented, but does not establish encryption of resident flash. Whole-flash encryption remains unverified.

User authentication

Criterion	Assessment	Evidence	Comment
Account management	Full	Source	Separate WebUI users and configurable read/write permission groups are documented. SSH account management has separate constraints.
Authentication	Basic baseline	Source	Password login is the baseline. Optional stronger methods require configuration; deployed settings and recovery security were not tested.
Brute-force protection	Exist	Source	IP blocking defaults on for failed SSH/WebUI logins, with a configurable threshold of 10 attempts.
Event logging	Partial logging	Source	Failed-login source, protocol and status are documented. Persistent retention and complete access auditing remain unverified.
Passwords	Require change after setup with complexity requirements	Source	First WebUI login requires replacing the default password; the manual specifies 8–32 characters, uppercase, lowercase, a digit and a special character.

Scope and evidence gaps

Documentation review dated 2026-10-25; no hands-on testing. Ratings describe the cited documentation, not every firmware version or installed configuration. Hardware-tampering frequency, resident-flash encryption and real-world attack frequency remain unscored. The exact commercial release date is unverified. No overall grade is assigned; administrator review and additional evidence are needed.

The vendor EOL table lists support through 2030-03-31. EOL transition does not mean support has already ceased.