FCC Bans Sale of New Foreign‑Made Consumer Routers Over National Security Risks
What Happened — The U.S. Federal Communications Commission (FCC) updated its Covered List to prohibit the sale of any new consumer routers manufactured outside the United States. The move follows a National Security Determination that foreign‑produced routers pose an unacceptable supply‑chain risk to critical infrastructure and national defense.
Why It Matters for TPRM —
- Supply‑chain risk: Vendors that source router hardware or firmware from overseas may now be deemed high‑risk third‑party providers.
- Regulatory compliance: Organizations must verify that any router or networking equipment used in their environment complies with the new FCC rules or has received an exemption.
- Cost & availability: Approved foreign devices may face longer certification timelines and higher prices, impacting budgeting and procurement strategies.
Who Is Affected — Telecommunications, enterprise networking, cloud‑service providers, and any organization that deploys consumer‑grade routers for office or remote‑work environments.
Recommended Actions —
- Inventory all router hardware and identify any models manufactured abroad.
- Validate that each device is either on the FCC‑approved list or has received an exemption.
- Update vendor risk assessments to reflect the heightened supply‑chain risk for foreign‑made networking equipment.
- Engage with vendors to obtain required disclosure on ownership, component origin, and U.S. manufacturing plans.
Technical Notes — The FCC’s Covered List is part of the Secure and Trusted Communications Networks Act of 2019. The ban targets “new” consumer routers; existing units may continue to be sold until they are phased out. The agency cites prior incidents where foreign‑made routers were leveraged by threat actors (e.g., Volt, Flax, Salt Typhoon) to compromise U.S. critical infrastructure. No specific CVEs are cited, but the risk is tied to potential firmware backdoors, insecure supply‑chain practices, and undisclosed foreign government influence. Source: BleepingComputer