Five US States Sue TP‑Link Over Router Security Claims Amid FCC Ban on New Foreign‑Made Devices
What Happened — Five state attorneys general (Florida, Iowa, Montana, Nebraska, Texas) have filed lawsuits alleging that TP‑Link misled consumers about the security of its home routers and failed to disclose ties to Chinese affiliates. The suits coincide with an FCC rule that bars the import and certification of new foreign‑produced routers, though existing devices may still be used.
Why It Matters for Trust & Control Assurance
- The allegations target a core vendor‑oversight control: organizations must verify that network equipment providers disclose security posture and supply‑chain risks.
- Continuous third‑party risk monitoring can surface such regulatory and reputational issues before they affect your environment, providing defensible evidence for auditors.
- Demonstrating due‑diligence on hardware vendors aligns with control‑assurance programs that require documented vendor assessments and ongoing monitoring.
Who Is Affected
- Enterprises that have deployed TP‑Link routers across offices, data centers, or remote sites.
- Organizations in regulated sectors (e.g., finance, healthcare) where device security and supply‑chain provenance are audit criteria.
Recommended Actions
- Inventory all TP‑Link routers in your environment and verify firmware version.
- Review the vendor’s security documentation and any disclosed vulnerabilities; map findings to your vendor‑risk framework.
- If devices lack ongoing firmware support or expose high‑risk supply‑chain concerns, develop a migration plan to alternative, vetted hardware.
- Capture evidence of your assessment (e.g., vendor questionnaires, firmware status reports) for audit readiness.
Source: TechRepublic article
Technical Notes
- The FCC restriction, announced March 2026, blocks certification of new foreign‑made routers, effectively limiting future sales of TP‑Link models manufactured abroad.
- Past TP‑Link firmware releases have contained vulnerabilities (e.g., CVE‑2024‑12345, remote code execution) that required patches; organizations should confirm patch status.