Loading story…
Florida Attorney General James Uthmeier filed a consumer-protection lawsuit against TP-Link, alleging that the company misrepresented its routers’ security and its ties to China and the Chinese Communist Party. Florida alleges that Chinese state-sponsored hackers exploited TP-Link routers in American homes and that many affected models lack automatic updates and no longer receive support. The state seeks an injunction, consumer restitution, and financial penalties. Similar lawsuits in Iowa, Nebraska, and Montana have increased pressure on the manufacturer, following federal investigations initiated in 2024.
TP-Link rejects the allegations, saying TP-Link Systems is an independent US company, separated from its Chinese parent in 2024, and is not owned or controlled by any foreign government. It says its US-market routers are manufactured in Vietnam, where production began in 2018. Separately, an FCC restriction on new consumer routers produced wholly or partly outside the US limits new product sales. TP-Link has applied for an exemption; Ars Technica reports it has not received one and cannot sell its latest Wi-Fi 8 routers in the US, while previously approved models remain eligible for sale. For enterprise buyers, the security allegations and regulatory constraints underscore the importance of checking router support lifecycles, update capabilities, and procurement eligibility; the lawsuits do not establish that every TP-Link device is compromised.
See the reporting duties and controls this puts on the clock.
15 events from the most recent confirmed update back to the earliest known activity.
On October 8, 2026, SEC Consult published technical details for CVE-2025-30237 through CVE-2025-30241 affecting 65 TP-Link Aginet models, showing how an unauthenticated attacker on the same network could fully compromise an affected device. Fixes distributed through ISPs extended into 2026, and researchers withheld proof-of-concept exploit code over concerns that many devices remained unpatched.
Nebraska Attorney General Mike Hilgers led a coalition of 21 state attorneys general urging the FCC to scrutinize TP-Link's application for conditional approval of new US-market router models. The action did not revoke existing product authorizations.
According to Florida’s complaint, the US Department of Defense designated TP-Link Technologies as a Chinese military company in June 2026. The designated entity is distinct from TP-Link Systems Inc., the defendant in Florida’s lawsuit.
SEC Consult reported five vulnerabilities affecting TP-Link's ISP-managed Aginet devices to the company in December 2024. The flaws were subsequently tracked as CVE-2025-30237 through CVE-2025-30241.
TP-Link moved its headquarters to California amid investigations into high-profile attacks linked to the Chinese government.
TP-Link says its US business separated from its Chinese parent company in 2024. Florida subsequently disputed the company's representations about its separation from China.
The Departments of Commerce, Defense, and Justice opened inquiries into TP-Link. The Justice Department inquiry examined potential unfair trade practices and national-security threats.
TP-Link says it has manufactured routers in Vietnam since 2018, a claim it cites in disputing allegations about its connections to China.
TP-Link corporate affairs officer Steve Kovsky rejected the lawsuits as based on false premises and unfairly penalizing a US company. TP-Link said its US-market devices are manufactured in Vietnam, that TP-Link Systems is not owned or controlled by a foreign government, and that it had supplied supporting documentation to state regulators.
Florida, Montana, Iowa, and Nebraska filed lawsuits on the same day alleging that TP-Link misled consumers about its China connections and router security, violating state consumer-protection laws. Florida sought an injunction, consumer restitution, and financial penalties.
Manufacturers receiving exemptions included Netgear, Asus, Adtran, Amazon and its Eero subsidiary, Calix, Nokia, and SpaceX's Starlink division.
TP-Link applied for conditional approval under the FCC restriction. Ars Technica reported that the company had not received an exemption and could not sell its latest Wi-Fi 8 routers in the United States.
The FCC announced a ban on consumer-grade routers produced wholly or partly outside the United States, with a conditional-approval pathway. Previously approved models remained eligible for sale.
Texas filed a lawsuit against TP-Link Systems in February, similar to the complaints alleging deceptive security representations and understated ties to the Chinese government.
Florida Attorney General James Uthmeier alleged that Chinese state-sponsored hackers exploited TP-Link routers in American homes. Attacks linked to the Chinese government that came under investigation included a botnet composed mostly of TP-Link routers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
9 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcescworld.com
Open sourcetechrepublic.com
Open sourcesecurityweek.com
Open sourcearstechnica.com
Open sourcetomshardware.com
Open sourcetp-link.com
Open sourcemyfloridalegal.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Texas Attorney General Ken Paxton filed a lawsuit against **TP-Link Systems Inc.**, alleging the company deceptively marketed its networking and smart-home devices as secure and privacy-protective while the products were allegedly exposed to exploitation by **China-linked state-sponsored actors**. The complaint also asserts TP-Link misled consumers about product origin—promoting “**Made in Vietnam**” labeling while claiming manufacturing and development are dominated by **China-based subsidiaries and supply chains**, with Vietnam facilities described as performing largely final assembly. Texas further argues that TP-Link’s China-linked supply chain and alleged affiliations create national-security risk, including the possibility of compelled cooperation under Chinese data and intelligence laws. The state cited prior public reporting and research— including a **May 2023 Check Point Research** report tying **Camaro Dragon** activity to exploitation of **TP-Link firmware vulnerabilities**—as part of its rationale that the devices have been leveraged in campaigns targeting U.S. interests. TP-Link rejected the allegations, calling the lawsuit “without merit,” and stated it is an independent American company with core operations and infrastructure located in the U.S.
Jun 29, 2026
The U.S. Federal Communications Commission granted large cable internet service providers a limited one-year waiver allowing manufacturers to replace certain parts in previously approved consumer routers without new certification. The waiver followed an NCTA request warning that the FCC’s earlier restrictions on foreign-made consumer routers could trigger shortages and supply-chain disruption, and it permits changes such as substrate materials and memory modules so existing models can stay in production. The FCC said the broader policy was driven by national security concerns, including evidence that routers have been used in hacking campaigns by actors including Chinese state-linked groups, while previously extending the deadline for software and firmware support on already approved devices until `2029-01-01`. The policy shift comes as scrutiny of router vendors intensifies, including a new Netgear counterclaim against TP-Link in Delaware federal court alleging false advertising over TP-Link’s portrayal of itself as an American company and its representations about product origin. Netgear argues TP-Link’s California reincorporation did not sever core ties to China-based leadership, R&D, and manufacturing, while TP-Link has accused Netgear of improperly linking it to cyber activity associated with the Typhoon threat groups. The dispute is unfolding alongside reviews by the Department of Defense, Commerce Department, FCC, FTC, and state attorneys general, underscoring how supply-chain security, vendor provenance, and router abuse in espionage campaigns are shaping U.S. broadband and device policy.
Jun 29, 2026
Multiple US federal agencies, including the Commerce, Justice, Defense, and Homeland Security departments, have backed a proposal to ban the sale of TP-Link routers in the United States. The move is driven by concerns that TP-Link, which controls a significant share of the US home router market, may still be subject to influence by the Chinese government, potentially exposing American users to surveillance risks. The proposal follows an investigation into the company's ties to China and comes amid heightened scrutiny of foreign technology firms over national security issues. Officials argue that mitigation measures short of a ban would not sufficiently address the perceived threat, although there is a possibility for TP-Link to provide guarantees that its hardware and software are developed independently of China. The company, which has established a US headquarters and claims to have separated from its Chinese parent, denies the allegations. The proposed ban could have sweeping implications for both consumers and businesses, echoing previous US actions against foreign technology providers such as Kaspersky Lab.
Jul 12, 2026