Five States Now Suing TP-Link Over Router Security: The Case at a Glance, Plus a Router Checklist
Florida, Iowa, Montana and Nebraska have joined Texas in suing TP-Link Systems over router security and China ties, and 21 attorneys general have written to the FCC. Here are the key facts and a checklist.
The legal pressure on router maker TP-Link grew this week. On October 6, four more states filed consumer-protection lawsuits against TP-Link Systems. TP-Link denies the claims and says it will fight them in court.
Our summary comes from Swati Khandelwal’s detailed report for The Hacker News, which walks through the complaints, the company’s response and the related research.
The case at a glance
- Defendant: TP-Link Systems of Irvine, California. Until a 2024 restructuring it was affiliated with Chinese firm TP-Link Technologies, which is not named in the suits.
- States suing: Florida, Iowa, Montana and Nebraska (filed October 6), joining Texas (filed in February). That makes five.
- Where: State courts, under consumer-protection laws.
- Claim 1, security marketing: The complaints quote TP-Link describing its HomeShield service as covering “all security scenarios” and contrast that with hacked routers and models that no longer get updates, such as two Archer AX21 versions that reached end of life in May 2024.
- Claim 2, separation from China: The complaints dispute TP-Link’s description of its independence. They say only 0.5% of the parts value at its Vietnam factory is sourced in Vietnam and the rest comes from or through China.
- Claim 3, privacy: The complaints say TP-Link’s apps (Tether, Tapo, Deco, Kasa Smart) collect emails, location and phone identifiers that a 2017 Chinese intelligence law could expose.
- What the complaints don’t claim: The Florida, Montana and Nebraska filings don’t allege that China has actually obtained customer data through TP-Link, and none of the three says TP-Link built a backdoor. Iowa’s announcement uses stronger wording in places.
- Penalties sought: Florida wants a permanent injunction, disgorgement and $10,000 per willful violation. Montana seeks up to $10,000 per violation. Nebraska also wants required disclosures about product origin, China ties and exploited vulnerabilities.
- TP-Link’s position: The company calls the suits “built on false premises,” says its U.S. devices are made in Vietnam, and says it does not share customer network data with foreign governments.
The related developments
- FCC letter: On October 7, 21 state attorneys general wrote to the FCC raising concerns as TP-Link seeks approval for new router models. The letter offers to work with the agency and doesn’t ask it to block approval.
- FCC router rule: Since March 23, new foreign-made consumer routers need a “Conditional Approval” to be authorized for sale. Routers authorized before the rule can keep getting security updates until at least March 1, 2027.
- ISP-supplied devices: Three of the complaints cite five flaws in TP-Link’s Aginet gear that ISPs provide. Together they can let an attacker on the same network take full control of the device. TP-Link disclosed them on August 10, and SEC Consult published the technical details on October 8. The 65 affected models include its HB, HX and HC mesh series, among others. Fixes reach users through their ISP, and neither advisory reports attacks using these flaws.
What this means for your company
Whatever the courts decide, the practical lesson for small offices is the same: the router is a security device, and it needs to be treated like one. Here is a checklist that applies no matter which brand you use.
- List every router, mesh unit and modem in your offices, including the ones your ISP installed and any in employees’ home offices that connect to company systems.
- Check the end-of-life status of each model. A device that no longer gets firmware updates should be replaced.
- For ISP-supplied gear, look for a firmware update in the device’s management page or app. If there isn’t one, ask your ISP whether it has been patched.
- Turn off remote management from the internet unless you need it, and change default admin passwords.
- Put a business-grade firewall you control between ISP equipment and your company network, and segment guest Wi-Fi from business systems.
Need help taking inventory of your network gear or replacing aging routers with equipment you can manage and patch? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
