Vulnerabilities · Networking
TP-Link Faces Lawsuits from Four US States Over Router Security and China Ties
Florida, Iowa, Montana and Nebraska have sued TP-Link, claiming it misled buyers about router security and its links to China. TP-Link denies the allegations and says it will fight them in court.
Ross GrantUpdated 4 min read
The short version
Four US states have sued TP-Link, a major Wi-Fi router maker, claiming it misled customers about how secure its routers are and how separate it is from China. The states say some TP-Link routers had security flaws that hackers exploited. TP-Link denies the allegations and says its US products are safe and made in Vietnam. The lawsuits do not claim that the Chinese government has actually accessed customer data, but they highlight risks and past attacks involving TP-Link devices.
By the numbers
- 4US states suing TP-Link in October 2026The Hacker News
- $10,000Maximum penalty per violation sought by Florida and MontanaThe Hacker News
- 2027Earliest scheduled jury trial for Texas lawsuitPCMag
- 0.5%Share of Vietnamese-sourced parts in TP-Link's Vietnam factory (by value)Ars Technica
What happened?
Attorneys general in Florida, Iowa, Montana and Nebraska have sued TP-Link Systems, alleging the company misled US buyers about the security of its routers and its separation from China. TP-Link denies the claims and says it will contest them in court. The lawsuits follow a similar case filed by Texas earlier in 2026.
The Lawsuits and Their Claims
On 6 October 2026, attorneys general from Florida, Iowa, Montana and Nebraska filed lawsuits against TP-Link Systems, a major Wi-Fi router manufacturer now based in California. The states allege that TP-Link misled US consumers about the security of its routers and the company’s separation from its Chinese origins. The suits claim TP-Link overstated the safety of its products, failed to disclose ongoing ties to China, and did not adequately inform buyers about known vulnerabilities or the origins of its hardware and software components [PCMag (opens in a new tab)][Ars Technica (opens in a new tab)][The Hacker News (opens in a new tab)].
These lawsuits follow a similar case filed by Texas in February 2026, which is still pending. The new complaints seek court orders to stop the alleged practices, financial penalties (up to $10,000 per violation in some states), and requirements for TP-Link to disclose more information to buyers.
Security and Supply Chain Concerns
The complaints focus on three main issues:
-
Router Security: The states argue that TP-Link advertised its routers as highly secure, but several models have known vulnerabilities. Some of these flaws have been exploited by hackers, including state-sponsored groups from China and Russia. For example, Microsoft reported in 2024 that a Chinese hacking group built a botnet using thousands of hacked TP-Link routers. The FBI also linked Russian hackers to attacks exploiting a specific TP-Link flaw (CVE-2023-50224), which allowed attackers to change router settings and steal passwords. TP-Link says most affected models were already at end of life by then [The Hacker News (opens in a new tab)].
-
Links to China: The lawsuits allege that TP-Link’s restructuring in 2024, which moved its headquarters to California, did not fully sever its ties to China. The complaints cite evidence that most components for US-bound routers are still sourced from China, even if final assembly happens in Vietnam. They also reference a 2017 Chinese intelligence law, which could theoretically expose data collected by TP-Link’s apps to Chinese authorities. TP-Link strongly denies that it shares any customer data with foreign governments.
-
Transparency: The states say TP-Link did not clearly inform buyers about the origins of its products, its ongoing links to China, or the risks posed by known vulnerabilities. Nebraska’s complaint specifically asks the court to require TP-Link to notify buyers about these issues.
TP-Link’s Response
TP-Link has called the lawsuits “coordinated” and “built on false premises.” The company says it complies with US privacy and data protection laws, uses independent security labs to test its products, and does not share customer data with foreign governments. TP-Link also says its US-market routers are manufactured in Vietnam and that it is not controlled by any foreign government. The company plans to fight the lawsuits in court [Ars Technica (opens in a new tab)][PCMag (opens in a new tab)].
Regulatory and Market Impact
These lawsuits come as the US Federal Communications Commission (FCC) has banned the sale of new foreign-made consumer routers unless the manufacturer gets a special exemption. TP-Link has not yet received such an exemption, so it cannot sell its latest Wi-Fi 8 routers in the US. Older models approved before the ban can still be sold and updated until at least March 2027. The FCC requires router makers to prove their products do not pose a national security risk and to outline plans for US-based manufacturing.
What Consumers Should Know
The lawsuits do not claim that TP-Link built intentional backdoors into its products or that the Chinese government has actually obtained customer data through TP-Link routers. However, they highlight real-world attacks where hackers exploited flaws in TP-Link devices. If you own a TP-Link router, keep its firmware up to date and check with your internet service provider or TP-Link for available security updates. Be aware of the privacy settings in any companion apps, and consider the origin of your networking hardware if you have specific privacy or security concerns.
What Happens Next
The lawsuits will proceed in state courts, with Texas’s case scheduled for a jury trial in October 2027. TP-Link’s ability to sell new routers in the US will depend on whether it secures FCC approval. The outcome could set precedents for how US regulators and courts handle security and supply chain transparency for foreign-linked technology companies.
Claimed vs confirmed
- Confirmed
TP-Link routers are vulnerable to exploitation by Chinese and Russian state hackers.
State and federal agencies, as well as Microsoft and the FBI, have reported real-world attacks exploiting TP-Link router flaws.
- Denied
TP-Link shares customer data with the Chinese government.
TP-Link says it does not and will not share customer data with foreign governments or unauthorised third parties.
- Unconfirmed
TP-Link has fully separated from its Chinese parent company.
TP-Link says it is independent, but lawsuits allege ongoing ties through sourcing and management.
The impact
- Money
- If found liable, TP-Link could face fines of up to $10,000 per violation under state laws. The company is also unable to sell new routers in the US without FCC approval, which could affect revenue.
- Reputation
- The lawsuits and regulatory scrutiny may damage TP-Link's reputation among US buyers, especially those concerned about privacy and national security.
- Customers
- TP-Link customers are advised to keep their routers updated and review privacy settings. The lawsuits do not claim that customer data has been accessed, but highlight risks from known vulnerabilities.
Why it matters
Millions of people use TP-Link routers at home and in small businesses. If the claims are true, buyers may not have been told about security risks or the origins of their devices. The lawsuits could affect what routers are available in the US and how companies must disclose security and supply chain information.
How does it work?
The lawsuits cite several known vulnerabilities in TP-Link routers that have been exploited by hackers, including password-spraying attacks and DNS hijacking. These attacks take advantage of flaws in router firmware, which is the software that controls the device. If a router is not updated or has weak security, attackers can take control, intercept data or use it as part of a larger botnet.
Key points
- Four US states have sued TP-Link over alleged misleading claims about router security and China ties.
- The lawsuits focus on security flaws, supply chain transparency, and privacy risks.
- TP-Link denies the allegations and says its US products are safe and made in Vietnam.
- The FCC has banned new foreign-made routers unless the maker gets an exemption; TP-Link has not yet received one.
- Consumers should keep router firmware updated and be aware of privacy settings in companion apps.
Sources
PCMag
Reference
Ars Technica
Reference
The Hacker News
Reference
