This top TP-Link router ships with some serious security flaws

Upgrading your wireless router with a new model from Amazon is certainly a good idea if you're working from home but new research from CyberNews has revealed that one of the most popular routers from TP-Link frequently featured on the ecommerce giant's store ships with vulnerable firmware.

Shenzhen-based TP-Link is the world's number one manufacturer of consumer WiFi networking products with yearly sales of 150m devices and a 42 percent share of the global consumer WLAN market. The company's routers are also often awarded “Amazon's Choice” badges in the “WiFi router” category on Amazon.

The TP-Link AC1200 Archer C50 (v6) is the best-selling “Amazon's Choice” Wi-Fi router in the UK and is mainly sold within the European market though another version is also available on Amazon's online store in the US.

We’ve built a list of the best wireless routers available
These are the best endpoint protection software solutions
Also check out our roundup of the best firewall

During its investigation into this router, CyberNews found numerous flaws within its default firmware as well as its web interface. For this reason, the news outlet recommends that all TP-Link AC1200 Archer C50 (v6) owners upgrade their devices to the latest firmware as soon as possible.

Known flaws in default firmware

According to CyberNews, the TP-Link AC1200 Archer C50 (v6) ships with outdated firmware that is vulnerable to dozens of known security flaws. WPS is also enabled by default on the device which could allow an attacker to brute-force the router while its admin credentials and configuration backup files are encrypted using weak protocols that could easily be broken.

At the same time, the default version of the router's web interface app suffers from multiple bad security practices and vulnerabilities including clickjacking, charset mismatch, cookie slack, private IP disclosures, weak HTTPS encryption and more.

Thankfully most of these flaws have now been patched but CyberNews points out that some were only patched halfway through. For instance, the backend of the router still seems to be secured in such a way that an attacker could potentially find an entry point within the web interface and re-exploit previously known flaws.

CyberNews reached out to TP-Link to inform the company of its discoveries and it said that it will force firmware updates on the affected devices while owners will receive “relevant notifications” about these updates via their management interface.

The lesson here is that while you may have purchased a brand new device from Amazon or any other online or offline retailer for that matter, you still need to take the time and ensure that your router is updated to the latest firmware to protect your network and your data.