This top TP-Link router ships with some serious security flaws

(Image credit: TP-Link)

Upgrading your wireless router with a new model from Amazon is certainly a good idea if you're working from home but new research from CyberNews has revealed that one of the most popular routers from TP-Link frequently featured on the ecommerce giant's store ships with vulnerable firmware.

Shenzhen-based TP-Link is the world's number one manufacturer of consumer WiFi networking products with yearly sales of 150m devices and a 42 percent share of the global consumer WLAN market. The company's routers are also often awarded “Amazon's Choice” badges in the “WiFi router” category on Amazon.

The TP-Link AC1200 Archer C50 (v6) is the best-selling “Amazon's Choice” Wi-Fi router in the UK and is mainly sold within the European market though another version is also available on Amazon's online store in the US.

Known flaws in default firmware

According to CyberNews, the TP-Link AC1200 Archer C50 (v6) ships with outdated firmware that is vulnerable to dozens of known security flaws. WPS is also enabled by default on the device which could allow an attacker to brute-force the router while its admin credentials and configuration backup files are encrypted using weak protocols that could easily be broken.

At the same time, the default version of the router's web interface app suffers from multiple bad security practices and vulnerabilities including clickjacking, charset mismatch, cookie slack, private IP disclosures, weak HTTPS encryption and more.

Thankfully most of these flaws have now been patched but CyberNews points out that some were only patched halfway through. For instance, the backend of the router still seems to be secured in such a way that an attacker could potentially find an entry point within the web interface and re-exploit previously known flaws.

CyberNews reached out to TP-Link to inform the company of its discoveries and it said that it will force firmware updates on the affected devices while owners will receive “relevant notifications” about these updates via their management interface.

The lesson here is that while you may have purchased a brand new device from Amazon or any other online or offline retailer for that matter, you still need to take the time and ensure that your router is updated to the latest firmware to protect your network and your data.

We've also highlighted the best malware removal software

Via CyberNews

TOPICS

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.