# Five U.S. States Take Legal Action Against Router Manufacturer Over Security and China Ties Concerns
## A Growing Legal and Regulatory Battle
A wave of lawsuits and regulatory pressure has been building against a major router manufacturer that supplies networking equipment to consumers across the United States. As of early October, five states have filed suit, and twenty-one state attorneys general have urged federal regulators to scrutinize the company’s approval process for new router models before they reach store shelves.
The company in question, headquartered in Irvine, California, once operated under a corporate structure closely tied to a Chinese technology firm. Although a 2024 restructuring was designed to sever that connection, state attorneys general argue that the separation remains incomplete — and that consumers have been misled about the safety and independence of the devices they purchase.
## The Lawsuits: What Five States Are Accusing
The complaints, filed in state courts, rest on three central pillars. First, the states argue that the company exaggerated the security protections built into its routers, particularly a built-in network protection service that was marketed as covering “all security scenarios” — even as known vulnerabilities left devices open to exploitation.
Second, they contend the company overstated how thoroughly it has separated itself from its Chinese roots. Despite the restructuring, the states point to evidence that thousands of employees in China still work for the related entities, and that nearly all components at the company’s Vietnamese manufacturing facility are sourced from or routed through China.
Third, the lawsuits claim that the company’s privacy policies fail to disclose a critical risk: under a 2017 Chinese intelligence law, data collected by the company’s apps — including email addresses, location information, and phone identifiers — could potentially be accessed by Chinese intelligence agencies.
Florida is seeking a permanent court order, forfeiture of profits from the disputed practices, and $10,000 for each intentional violation. Montana is pursuing up to $10,000 per violation, while Nebraska is requesting that the company be required to disclose the origins of its products and components, its relationships with Chinese entities, and known security vulnerabilities that have been exploited. Iowa’s filing, while similar to the others, contains notably stronger language about the potential for data access by the Chinese government.
## The Company’s Defense
The manufacturer has denied all allegations and stated it intends to contest the suits. In a public response, the company’s corporate affairs officer described the lawsuits as “built on false premises,” arguing that they unfairly harm an industry-leading American company without advancing national security.
The company has emphasized that it provides regulators with documentation showing that its U.S.-market routers are manufactured in Vietnam, and it describes itself as an independent American company not owned or controlled by any foreign government. It also maintains that it does not and will not share customer network data with foreign governments or unauthorized parties.
## Real-World Attacks and Exploits
The state complaints reference several documented incidents involving the company’s routers, lending weight to the argument that the security concerns are not theoretical.
In 2024, Microsoft reported that a hacking group it attributes to China had constructed a large network of compromised small-office and home routers. Microsoft identified TP-Link devices as making up the majority of this network, with an average of 8,000 hijacked devices active at any given time. The compromised routers were used for password-spraying attacks, in which attackers attempted common passwords across numerous accounts.
Separately, the FBI disclosed in April that Russian military intelligence operatives had exploited a specific vulnerability in TP-Link routers to alter DNS settings and harvest passwords and login tokens. The company confirmed that most affected models had already reached end of life.
Additionally, testimony given before a U.S. House committee in 2025 by a former cybersecurity director of the National Security Agency identified TP-Link routers among the brands used by Chinese state-backed hacking groups in certain campaigns. The company has disputed this characterization, stating those campaigns show no particular preference for its products.
Notably, none of the state complaints accuses the company of building a backdoor into its own devices. The only backdoor referenced in the suits, known as Horse Shell, was reportedly installed on the company’s routers by a Chinese state-backed hacking group, according to research from Check Point.
## The FCC and the Fight Over New Router Approvals
The day after the lawsuits were filed, twenty-one state attorneys general sent a letter to the Federal Communications Commission raising concerns about the company’s bid for approval on new router models. The FCC has, since March 2024, blocked new consumer routers manufactured in foreign countries from receiving standard equipment authorization. The only pathway for such routers to be sold in the U.S. is through a “Conditional Approval” process overseen by the Department of Homeland Security or the Department of Defense.
The attorneys general’s letter highlights three areas of concern: the company’s security claims, its assertions about Vietnamese manufacturing and separation from China, and the gaps in its privacy disclosures related to Chinese intelligence law. The letter does not request that the FCC deny or delay approval — instead, it invites the agency to collaborate on addressing the identified risks.
One state attorney general expressed hope that the FCC would deny the company’s request for Conditional Approval entirely.
## Five Critical Vulnerabilities in ISP-Distributed Equipment
A separate but related issue involves security flaws discovered in a line of mesh routers, routers, and modems that internet service providers install and manage on behalf of their customers. The Florida, Montana, and Nebraska complaints cite these flaws as further evidence that the company’s security promises fall short of reality.
Security researchers published technical details of five vulnerabilities in October 2025, roughly twenty months after first reporting them to the company. Collectively, the flaws could allow an unauthenticated attacker on the same local network to gain full control of an affected device, including the highest-level access privileges. The most severe vulnerability allows an attacker with network access to the device’s web management interface to create an administrative account and enable remote access — without needing any login credentials.
Other flaws range from allowing low-privilege users to create high-privilege accounts, to enabling attackers to decrypt stored passwords using hardcoded encryption keys specific to each model, to permitting file access through specially crafted USB connections and elevated command execution through login credentials.
The affected models span dozens of product lines, though not all devices are impacted by every vulnerability. Because these are ISP-managed devices, firmware updates are delivered exclusively through each internet provider, and some customized versions may not be available for direct public download. The researchers found no workaround for the vulnerabilities, and as of their publication, no confirmed attacks exploiting these specific flaws had been reported.
## Frequently Asked Questions
**Q: Why are five states suing TP-Link specifically?**
A: The states argue that TP-Link made specific claims about router security and corporate independence that they believe were false or misleading. Texas filed first in February, and four additional states — Florida, Iowa, Montana, and Nebraska — joined in October 2025.
**Q: Is the company headquartered in China?**
A: No. TP-Link Systems is incorporated and based in Irvine, California. However, until a 2024 restructuring, it was affiliated with TP-Link Technologies, a Chinese company. The lawsuits do not name the Chinese entity as a defendant.
**Q: Are the routers used in the United States made in China?**
A: The company states that U.S.-market routers are manufactured in Vietnam. The states counter that 99.5 percent of parts used at the Vietnamese factory, by value, are sourced from or through China.
**Q: Has the company been caught installing backdoors?**
A: No. The complaints do not allege that TP-Link built backdoors into its products. The only backdoor mentioned — Horse Shell — was placed on the company’s routers by an external Chinese state-backed hacking group, according to Check Point Research.
**Q: What should consumers do if they own affected devices?**
A: Users should check their router’s management interface or companion app for available firmware updates. If no update is available, they should contact their internet service provider, as ISP-distributed models receive updates through the provider rather than directly from the manufacturer.
**Q: Is the FCC planning to ban the company’s new routers?**
A: Not automatically. The FCC has created a Conditional Approval pathway for foreign-made routers that pass additional security review. The attorneys general have urged the FCC to address their concerns before granting such approval but have not formally asked for a denial.
**Q: Could these vulnerabilities affect my home network?**
A: The ISP-supplied device flaws require an attacker to already be on the same local network, which means they are primarily a concern in shared or compromised network environments. The older vulnerabilities cited in the lawsuits — exploited by nation-state actors — affected devices that are no longer receiving updates.
## Looking Ahead
The intersection of consumer technology, international supply chains, and national security is creating a complex legal and regulatory landscape. As router manufacturers navigate the expectations of both global manufacturing efficiency and domestic security concerns, the outcomes of these lawsuits and FCC proceedings could set important precedents for transparency and accountability in the networking industry.
Whether the courts find in favor of the state attorneys general or the manufacturer, the cases underscore a broader demand from consumers and regulators alike: that the companies selling devices at the gateway of our home networks must be honest about where those devices come from, how secure they are, and what risks their users actually face.
The FCC’s forthcoming decisions on new router approvals will be closely watched, as they may influence not just one company’s product pipeline but the standards applied to all foreign-manufactured networking equipment entering the American market.
Thank you for reading
