Four States Sue TP-Link: A Full Breakdown of Router Security and Supply Chain Disputes

Four States Join Forces to Sue TP-Link: A Router Security and Supply Chain Trust Crisis

Attorneys general from four U.S. states acted simultaneously on October 6, with Florida, Iowa, Nebraska, and Montana each filing consumer protection lawsuits against TP-Link Systems, alleging the router maker misled consumers about product security and its ties to Chinese operations. On the same day, TP-Link issued a strongly worded response.

The core tension in this cluster of lawsuits comes down to three facts yet to be proven: whether the routers' security claims hold up, where components actually come from, and what the corporate governance relationships truly are. All three bear on security decisions, and none can be settled by a press release or a legal complaint alone.

Core Allegations of the Lawsuits

The complaints from the four states use different legal language to express the same two accusations: TP-Link overstated how secure its routers are while downplaying its reliance on Chinese supply chains for R&D and manufacturing. Florida Attorney General James Uthmeier accused the company of misleading consumers and is seeking fines of up to $10,000 per willful violation, rising to $15,000 if the violation targeted seniors, people with disabilities, service members, or veterans.

Iowa's filing directly calls out the security claims, citing product marketing phrases such as "secure guest Wi-Fi access," "refined password security," and "a whole new level of network security." It also references federal-level materials, including warnings from the FCC's Public Safety and Homeland Security Bureau—compromised routers can enable deep network surveillance, data exfiltration, botnet attacks, and unauthorized access to government or corporate networks.

Nebraska's filing provides the most striking figure: TP-Link controls at least 60% of the U.S. retail market for Wi-Fi systems and small office/home office routers. It further argues that the vast majority of components at the company's Vietnam factory are imported from or transshipped through China, and that the contractor that built the factory has ties to the Chinese military.

The FCC Public Safety and Homeland Security Bureau refers to two key bodies under the U.S. Federal Communications Commission (FCC). The Public Safety and Homeland Security Bureau (PSHSB) is primarily responsible for coordinating emergency communications and network restoration when communications networks face threats such as natural disasters, terrorist attacks, or cyberattacks, and for issuing related security warnings; the FCC's homeland security function focuses on communications supply chain security, including risk assessments of foreign-made equipment. The weight of these two bodies' warnings about routers stems from the fact that they are not ordinary consumer advisories but assessments based on federal-level risks to communications infrastructure. Compromised routers are dangerous because they sit at the network edge—the mandatory path for traffic—allowing attackers to conduct man-in-the-middle attacks, DNS hijacking, traffic mirroring, and more, all while being nearly undetectable to ordinary users.

Actionable Security Details: Firmware Support Status

Among all the allegations, there is one detail that stands independent of the lawsuits' outcome and that buyers can verify today. Florida's complaint names several older models, including the TL-WR940N, Archer C7, and early versions of the Archer AX21, some of which no longer receive security updates and do not support automatic firmware updates.

A device that cannot update itself retains its factory vulnerabilities indefinitely, and such hardware often goes uninventoried at small businesses. An unpatched router is a network-wide problem in a small office network—it can see every bit of traffic leaving the site, and it holds credentials for connecting to the internet service provider as well as the administrative interface for Wi-Fi and guest access.

The rule to implement immediately is simple: for every router on site, record the model, firmware version, and the date the vendor last released an update, then replace or isolate devices the vendor no longer maintains. If the device sits on a guest network or a segmented VLAN, the exposure surface shrinks and the urgency to replace it decreases accordingly.

End-of-Support (EoS) refers to the date a vendor formally stops providing firmware updates, security patches, and technical support for a product. Once a device reaches EoS status, any security vulnerabilities discovered thereafter will no longer be fixed, and the device remains permanently on a known-insecure firmware version. A related concept is End-of-Life (EoL), which typically means the product is no longer sold but may still be within its support period. For network equipment, the EoS date matters more than the EoL date, because the cessation of security updates is the point at which exposure risk rises sharply. Many vendors publish EoS/EoL notices on their websites, but the information is often scattered and inconspicuous, so procurement and operations staff need to actively look it up and record it. For routers that no longer receive updates, network segmentation is a mitigation measure: isolating the device on a separate VLAN or guest network limits its ability to move laterally and access core resources after compromise, reducing risk until replacement is completed.

What 60% Market Share Means

Scale is why a single vendor's support policy becomes a public issue. When one vendor holds this kind of market share, any change to its firmware policy simultaneously affects a large portion of the market, including sites that never made an explicit security-driven purchasing decision.

Regulatory pressure adds another layer. According to Ars Technica, these lawsuits came after the FCC banned consumer-grade routers manufactured wholly or partly within the United States. On October 7, 21 state attorneys general led by Nebraska sent a letter to the FCC questioning TP-Link's application for conditional approval to sell new routers in the U.S., arguing that its China ties constitute a security concern the FCC must resolve before deciding. Compliance issues now attach to the product category itself, which changes the scope of what procurement decisions cover.

For SMBs outside the U.S., the takeaway is narrower but still useful: vendor identity and jurisdiction show up in threat models, update processes, and how quickly support commitments can be verified. The practical approach is to treat these as matters that need evidence-based answers before purchase.

The FCC ban on consumer-grade routers manufactured wholly or partly within the United States is a regulatory action typically based on the FCC's Equipment Authorization rules. The FCC can, on national security grounds, place specific vendors or equipment from specific sources on the "Covered List," barring them from obtaining the equipment certification required for U.S. sales. Routers, as the critical node connecting user networks to internet service providers, are viewed as part of communications infrastructure and are therefore subject to FCC regulation. Once a router is placed on the prohibited list, the vendor cannot obtain an FCC ID for new models and thus cannot legally sell them in the U.S. The FCC approval process allows vendors to apply for conditional approval, but attaches security review conditions, such as requiring disclosure of supply chain information or acceptance of third-party audits. The state attorneys general's letter to the FCC is precisely an attempt to apply pressure at the administrative approval stage and bring supply chain security concerns into the decision-making process.

Network Equipment Vendor Risk Assessment Checklist

Five questions cover most of the exposure surface, and each has a verifiable answer:

• What firmware version does the model run, and what is the vendor's announced end-of-support date?
• Does the device update firmware automatically, and can that process be verified on the network?
• Where is the vendor registered, and which jurisdiction governs its data processing obligations?
• Which third party has reviewed the product, and are the results public?
• If support ends this year, what is the replacement path?

Two of these questions change the outcome immediately, and neither requires a legal ruling. Devices with published end-of-support dates let buyers plan replacement budgets; devices that cannot update their own firmware should be moved to a segmented network until replaced, because segmentation limits what a compromised router can reach.

TP-Link's response called the lawsuits built on false premises, stating that products sold in the U.S. are manufactured in Vietnam, that the company is independent of any foreign government, and that it does not share customer network data with foreign governments or unauthorized third parties. But the disagreement between these claims and the complaints will ultimately need to be resolved by a court. For network administrators, the time spent waiting for a ruling can be used to inventory the devices in their own networks that have already stopped receiving updates.

One-line Summary

Four U.S. states sue TP-Link for overstating router security and downplaying Chinese supply chain reliance, spotlighting network equipment vendor risk.

Paragraph Summary

On October 6, 2025, attorneys general from Florida, Iowa, Nebraska, and Montana simultaneously sued TP-Link, alleging it overstated router security and downplayed reliance on Chinese supply chains. Nebraska noted TP-Link holds at least 60% of the U.S. retail market for Wi-Fi and small office routers, with its Vietnam factory sourcing most components from China. The lawsuits name older models like the TL-WR940N and Archer C7 as no longer receiving security updates. The same day, 21 state attorneys general wrote to the FCC demanding China ties be resolved before approving new TP-Link routers. TP-Link denies the allegations, saying products are made in Vietnam and it is independent of foreign governments. The article advises businesses to immediately inventory router firmware versions and replace or isolate unsupported devices.