@Kevin_Z Thank you for your reply.

Sorry i didn't express clearly.

I means I have already disable wps function in the management web page.

But wps was not really disabled.

And this bug also exists in Archer C7 V4

Please use wifi analyzer to check this issue.

Thank you very much.

@YangYang yeah, I also found this in C6. But after I disabled the WPS funtion like you did, then I tried to connect my devices to C6 via WPS, but failed. So the WPS function is indeed disabled. Maybe it's just a display problem. So the WPS is off totally on Archer C6 and my network is safe. 

@YangYang I ran a check to Archer c6  used wash Version in kali linus to know WPS feature.. thought is seems like WPS option  is enabled and lock staus is set to NO.. this is a major flaw in C6 router and i can crack wifi password in a min using this vulnerability. 

Update a firmware with Locking WPS feature. 

Note :- wps and WPS pin feature is disabled before running this test.

Hi,

Does anyone know how to raise a ticket in TP-link support?

This is a major security flaw and it hasn't been solved for months (or even years)

Hi,

Just in case anyone is interesed, the beta firmware posted in this link seems to solve both WPS (broadcast of WPS even when disabled) and Onemesh (broadcast of hidden network) issues

https://community.tp-link.com/en/home/forum/topic/170160?page=1

This firmware allows to completely disable WPS and Onemesh

I'd like to suggest tplink to always allow users to disable new features. It's great to have new features and I understand that it's even helpful to enable them by default, but allowing advanced users to disable them in case they don't need them is also a good practice