I Scanned 4 Popular Indian Routers for Security Vulnerabilities. Every Single One Failed.

@Mainekhacker | Security Researcher

There are roughly 500 million WiFi routers active across India right now. Most of them have never received a security update. Most of their owners have no idea what software is actually running inside.

I wanted to find out.

Over the past several months, I built FirmSec a free, open-source IoT firmware vulnerability scanner and used it to analyse the latest official firmware from four popular routers sold in the Indian market: the TP-Link , Xiaomi and Netgear.

The results were worse than I expected.

Why I Built FirmSec :

The honest answer: No free tool existed that did what I needed.

Commercial options like Binwalk Pro exist, but they cost enterprise money, are closed-source, and aren't designed for independent researchers or students. I needed something I could run on Kali Linux, point at a firmware image downloaded from tp-link com, and get a readable vulnerability report from.

So I built it myself.

FirmSec is a Python-based firmware analysis pipeline with a Flask web UI. You upload a firmware file, it extracts the filesystem, and then runs seven analysis modules in sequence — credential scanning, CVE lookup via the NIST NVD API, binary protection analysis, entropy-based firmware type detection, and a PDF report generator.

The full source code is on GitHub. It's free. You can scan your own router's firmware right now.

What I Found: The Short Version

Device Risk Score Most Critical Finding TP-Link TL-WR845N 70/100 HIGH BusyBox 1.19.2 (2012) — CVSS 9.8 RCE vulnerability

TP-Link Archer C6 V2 85/100 CRITICAL 2 embedded RSA private keys Xiaomi Mi Router 4C 100/100 CRITICAL 3+ embedded HTTPS server keys Netgear R6350 V1 100/100 CRITICAL Complete OpenVPN PKI embedded in public firmware.

Every device. Every brand. Every price point. All critical.

Finding 1: Zero Binary Protections — Across All Four Devices

This is the finding I consider most significant.

Modern software uses four standard memory protection mechanisms that make buffer overflow vulnerabilities extremely hard to exploit even when they exist:

• NX (No-Execute) — prevents injecting malicious code into memory
• PIE (Position Independent Executable) — enables ASLR, randomises memory layout
• Stack Canary — detects buffer overflows before they execute
• RELRO — prevents attackers from overwriting function pointers in memory

Every single binary on every single device I tested failed all four checks.

I want to be precise about what that means. Buffer overflows are one of the most common vulnerability classes in C code. These four protections are what make the difference between "there's a bug" and "someone can exploit that bug over the network right now." Without them, any buffer overflow in any binary is immediately, trivially exploitable.

How many potentially vulnerable functions did FirmSec find? The strcpy, gets, sprintf, and memcpy calls C functions that do zero bounds checking ranged from 68 instances on the TL-WR845N to 358 instances on the Mi Router 4C.

This is not a firmware bug. This is a deliberate build-time decision manufacturers disable security compiler flags to reduce binary size on resource-constrained hardware. The side effect is that every device in millions of Indian homes has no memory protection whatsoever.

Finding 2: Libraries from 2012, Still Shipping in 2026

The second pattern across all devices: old libraries. Very old libraries.

Device Library Version Year Released Age in 2026

TL-WR845N V4 BusyBox 1.19.2 2012 14 years

TL-WR845N V4 OpenSSL 0.9.8z 2014 12 years

Mi Router 4C curl 7.33.0 2013 13 years

Mi Router 4C OpenSSL 1.0.1j 2014 12 years

Netgear R6350 curl 7.57.0 2017 9 years

Archer C6 V2 OpenSSL 1.0.2u 2019 7 years

The average library age across all tested devices: 9.5 years.

The most severe CVE FirmSec found during this research was CVE-2022–48174 — a stack overflow in BusyBox's ash shell with a CVSS score of 9.8 (CRITICAL).

It was published in August 2022. The TP-Link TL-WR845N shipped with BusyBox 1.19.2 from 2012 meaning this router is running a version of BusyBox that is 4 years older than even the 2022 CVE. It has never been patched and likely never will be.

CVSS 9.8 means: network exploitable, no authentication required, full device compromise. If you're on the same WiFi network as this router, you can potentially own it completely.

Other notable CVEs found:

CVE Library CVSS Impact;

CVE-2022–48174 BusyBox 1.19.2 9.8 Remote code execution via ash shell.

CVE-2017–8816 curl 7.57.0 9.8 NTLM buffer overflow.

RCE CVE-2017–8817 curl 7.57.0 9.8 FTP wildcard out-of-bounds.

CVE-2014–0224 OpenSSL 0.9.8z 7.4 SSL/TLS traffic decryption.(CCS Injection).

CVE-2022–22576 curl 7.33.0 8.1 OAuth2 credential leak.

Finding 3: Private Keys in Public Firmware:

This is the finding that made me stop and stare at my terminal for a moment.

Three of the four routers contain RSA private keys embedded directly in their publicly downloadable firmware images.

Private keys are supposed to be secret. They are the cryptographic proof of identity the secret that signs certificates, authenticates servers, and protects encrypted sessions. When a manufacturer embeds a private key in firmware that anyone can download from their official website, it is no longer private. It is, by definition, a public key.

Device Keys Found Location Purpose Archer C6 V2 2 usr/lib/libssh.so.4.4.1 SSH server identity Mi Router 4C 3+ etc/sysapihttpd/server.key HTTPS admin panel Netgear R6350 usr/etc/openvpn/******,*******,*******keys OpenVPN PKI

The Netgear R6350 finding is the most severe. The router ships with a complete OpenVPN Public Key Infrastructure CA certificate, server key, and client key all embedded in the firmware. If any R6350 user enables the built-in VPN feature:

• The CA key is public → an attacker can sign fraudulent certificates trusted by any R6350 device
• The server key is public → an attacker can impersonate your VPN server
• The client key is public → an attacker can impersonate any VPN client
• All VPN traffic can be decrypted by anyone who downloaded the firmware

The firmware is publicly downloadable from netgear.

Finding 4: Psswords Sent Over Plain HTTP:

A smaller but concrete finding on the TP-Link TL-WR845N: the binary usr/bin/noipdns which manages the No-IP Dynamic DNS service constructs HTTP GET requests containing your No-IP account password as a plain text URL parameter:

GET /nic/update?hostname=%s&password=%s&h[]=%s HTTP/1.1

GET /nic/update?hostname=%s&password=%s&h[]=%s HTTP/1.1

This means your No-IP credentials are transmitted in plaintext over HTTP, visible to any passive observer on the network path your ISP, anyone on your local network, any middlebox between you and No-IP's servers.

This is the kind of finding that's easy to miss in dynamic testing (you'd have to specifically intercept that traffic at the right moment) but static firmware analysis catches instantly.

How FirmSec Works:

The core technical challenge in firmware analysis is signal-to-noise ratio. Most naive scanners produce hundreds of false positives JavaScript variable names containing the word "password," configuration file comments, help text strings. The result is a 300-item finding list where the actual vulnerabilities are buried.

FirmSec's credential scanner solves this by splitting files into two categories:

• System/config files — etc/passwd, etc/shadow, .conf files, SSH keys — scanned with strict patterns
• Web UI files — HTML, JavaScript — where var password = "" is noise, not a finding

The result is 5 to 15 real findings instead of 300 noise entries.

The CVE lookup engine uses the NIST NVD API with correct CPE query formatting a subtle but important detail. Querying "busybox 1.19.2" returns zero results. Querying "BusyBox BusyBox 1.19.2" (vendor + product in CPE format) returns the correct CVE list. A static fallback database handles NVD rate limiting.

For detection and extraction, FirmSec uses entropy analysis to distinguish between firmware types encrypted firmware looks different from compressed Linux firmware looks different from RTOS firmware. Then Binwalk + unsquashfs extracts the filesystem for analysis

If you own any of the devices tested:

1. Change your admin password if still using the default.
2. Disable remote management — the admin panel should only be accessible from inside your home network.
3. Disable the VPN feature on Netgear R6350 until patched.
4. Check your manufacturer's website for firmware updates.
5. Consider OpenWrt if your router model supports it actively maintained open-source firmware.

Try FirmSec Yourself:

FirmSec is free and open-source. It runs on Kali Linux.

GitHub: FIRMSEC

Download the official firmware for your router from the manufacturer's website. Run FirmSec on it. See what's inside.

Or there is another way to do it. By using IOT tools Extract Firmware from router Manually.

Legal notice:_ Only scan firmware from devices you own or have explicit written permission to tet. All firmware in this research was downloaded from official manufacturer websites under their public download policies._

I AM_ cybersecurity researcher. I build open-source security tools and publishes sometimes do research at @Mainekhacker on YouTube, Instagram, and Medium._

Found this useful?_ Follow for more firmware research, bug bounty writeups, and open-source security tools._

Thankyou For Reading:)