Post-20250919 router admin-surface audit (disable WAN admin, WPS, UPnP, cloud binding) #108

New issue

Closed

opened 2026-05-24 21:45:37 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-24 21:45:37 +00:00

Owner

Problem

The TP-Link Archer A20 ships with several admin-surface defaults that are unsafe by modern threat-model standards. After the 20250919 firmware upgrade (tracked separately by the session that filed this issue), the router's admin surface needs an end-to-end audit and lockdown sweep.

Scope - in

Disable WAN-side admin (remote management). Verify only LAN/tailnet can reach the admin UI.
Disable WPS entirely.
Disable UPnP. Downstream effect: also closes the root cause behind #106 (BT client saturating UPnP and evicting other devices' port mappings). Any device that needed UPnP gets a static port forward instead.
Disable any TP-Link 'cloud' / TP-Link ID account binding. The router should not have an outbound control plane that isn't Kai's.
Rotate the admin password if it hasn't been rotated post-upgrade. Store in SSM at /coilysiren/home/tplink-admin-password (already anticipated by #107).
Audit the guest network, DMZ, ALG, and any 'open VPN client/server' features the new firmware may have enabled by default.

Scope - out

Replacing the router (tracked in the sibling Ubiquiti-evaluation ticket).
Playwright automation (#107). This sweep is one-shot manual; if automation ever happens it should re-apply the same end state.

Why now

Router CVE = pre-auth, pre-LAN, owns DNS+DHCP+gateway+TLS-MITM surface for the whole home network. Highest-leverage hardening surface on Kai's stack.

Filed by Claude.

**Problem** The TP-Link Archer A20 ships with several admin-surface defaults that are unsafe by modern threat-model standards. After the 20250919 firmware upgrade (tracked separately by the session that filed this issue), the router's admin surface needs an end-to-end audit and lockdown sweep. **Scope - in** 1. Disable WAN-side admin (remote management). Verify only LAN/tailnet can reach the admin UI. 2. Disable WPS entirely. 3. Disable UPnP. Downstream effect: also closes the root cause behind #106 (BT client saturating UPnP and evicting other devices' port mappings). Any device that needed UPnP gets a static port forward instead. 4. Disable any TP-Link 'cloud' / TP-Link ID account binding. The router should not have an outbound control plane that isn't Kai's. 5. Rotate the admin password if it hasn't been rotated post-upgrade. Store in SSM at `/coilysiren/home/tplink-admin-password` (already anticipated by #107). 6. Audit the guest network, DMZ, ALG, and any 'open VPN client/server' features the new firmware may have enabled by default. **Scope - out** - Replacing the router (tracked in the sibling Ubiquiti-evaluation ticket). - Playwright automation (#107). This sweep is one-shot manual; if automation ever happens it should re-apply the same end state. **Why now** Router CVE = pre-auth, pre-LAN, owns DNS+DHCP+gateway+TLS-MITM surface for the whole home network. Highest-leverage hardening surface on Kai's stack. **Filed by Claude.**

coilysiren added the

priority

label

2026-06-04 08:16:54 +00:00