**Legal Scrutiny Intensifies for TP-Link Over Security Claims and Foreign Ties**
A wave of legal action has swept across the United States, with state prosecutors taking aim at a major networking hardware manufacturer. Attorneys general from Florida, Iowa, Montana, and Nebraska officially filed suit against the company on October 6 in their respective state courts. Texas had already pursued a comparable legal path earlier in February. All of these cases rely heavily on individual state consumer protection statutes.
The central accusation revolves around deceptive business practices. The lawsuits contend that the company’s promotional materials vastly exaggerate the protective nature of its consumer hardware. Of particular focus is a subscription-based security service that allegedly marketed itself as providing a “100% safeguard” and covering “all security scenarios.”
To demonstrate the gap between these claims and reality, the states highlighted testimony from Congress detailing how the company’s routers were compromised during the Volt Typhoon and Flax Typhoon cyber campaigns. The suits also reference the use of the company’s devices in botnets for password-stuffing attacks orchestrated by Chinese threat actors, alongside intrusions by Russian hacking groups. Furthermore, many of the compromised models lack automated firmware update features and have ceased receiving security patches entirely.
The legal complaints also challenge the company’s narrative of separation from China. Prosecutors argue that substantial amounts of research, development, and manufacturing still occur within the People’s Republic of China. They specifically point out that at a production facility in Vietnam, merely 0.5% of components by value are locally sourced. The lawsuits further assert that the company’s privacy policies omit the fact that its Chinese affiliates are bound by the nation’s intelligence-gathering laws. The states also highlight the company’s failure to disclose Chinese regulations from 2021, which mandate that newly discovered software vulnerabilities must be reported directly to the government. The suits are seeking judicial injunctions, civil penalties, consumer restitution, and jury trials.
To illustrate the persistent nature of these security flaws, the lawsuits cite findings from independent researchers who discovered five critical vulnerabilities in August, tracked as CVE-2025-30237 through CVE-2025-30241. These issues affect a line of ISP-managed mesh systems, routers, and modems. The research firm warned that an unauthenticated intruder on the same local network could completely compromise the affected devices. The most severe flaw involves an authentication bypass that allows an attacker to create a top-level administrator account and enable secure shell access without credentials. Other flaws include privilege escalation for low-level users, command injection granting root access, and hardcoded encryption keys that can be extracted to reveal Wi-Fi passwords and administrative credentials. The fifth vulnerability requires physical access, allowing an attacker to read the device’s entire filesystem via a malicious USB drive.
The manufacturer identified 65 different product variants as vulnerable. Researchers began reporting these issues in late 2024, with initial fixes rolling out in early 2025, though a complete patch distribution across all affected Internet Service Provider models is expected to stretch into 2026. The researchers opted not to release public proof-of-concept code, fearing it would be exploited on the many still-unpatched devices in circulation.
In response, the manufacturer has firmly rejected these allegations. A corporate spokesperson called the legal efforts “baseless,” arguing they fail to advance national security while unfairly targeting a leading domestic industry player. The company claims it has provided extensive documentation to state regulators proving that its American devices are manufactured in Vietnam and operate independently of any foreign government.
Shortly after the lawsuits were filed, the Montana attorney general joined a coalition of 21 states in urging the Federal Communications Commission (FCC) to scrutinize the company. The FCC is currently evaluating the company’s request for conditional approval to sell new router models in the US, a process that gained complexity after the agency added foreign-manufactured routers to its restricted list earlier this year. The Montana attorney general expressed that the routers should be viewed as a potential surveillance threat and hoped the FCC would deny the company’s application for the sake of national security.
***
**FAQ Section**
**Q1: Why are state attorneys general suing TP-Link?**
The suits allege that TP-Link violated state consumer protection laws by misleading customers about the security of its products and its independence from foreign government influence. The lawsuits specifically target deceptive marketing regarding a subscription security service and a lack of transparency regarding the company’s supply chain.
**Q2: What specific security breaches are cited in the lawsuits?**
The lawsuits reference the Volt Typhoon and Flax Typhoon campaigns, where TP-Link routers were compromised by Chinese state-sponsored actors. The suits also reference the formation of botnets using TP-Link devices for credential attacks, as well as intrusions by Russian hacking groups that specifically targeted the company’s hardware.
**Q3: What are the critical vulnerabilities discovered by researchers?**
Five flaws (CVE-2025-30237 to CVE-2025-30241) affect ISP-managed devices. They range from authentication bypasses allowing remote administrator access and command injections granting root privileges, to hardcoded encryption keys exposing user credentials and physical USB-based filesystem extraction.
**Q4: How is TP-Link responding to the allegations?**
TP-Link maintains that the lawsuits are founded on false premises. The company states that its US products are manufactured in Vietnam, are not owned or controlled by foreign governments, and that the security concerns raised by the states are entirely unfounded.
**Q5: What role does the FCC play in this situation?**
The FCC is currently reviewing TP-Link’s application for conditional approval to sell new routers in the US. Multiple states are pushing the FCC to deny this approval, citing national security concerns and the company’s ties to China.
***
**Conclusion**
The ongoing legal battles mark a significant escalation in the scrutiny facing global technology supply chains. As states intensify their focus on consumer protection and national security, the outcome of these lawsuits could redefine how networking hardware manufacturers disclose their operations and security practices. With pending regulatory decisions at the FCC and a wave of technical vulnerabilities still being patched across the industry, the situation remains highly volatile for both the manufacturer and its consumers.
Thank you for reading
