TP-Link faces state lawsuits and FCC sales ban over router security flaws

Four US states sue TP-Link while the FCC blocks new router sales pending an exemption request from the vendor.

Threat Times Disclosure DeskOctober 8, 20262 min read

Illustration: A white plastic wireless router with two antennas sits on a wooden desk. — AI-generated illustration: Threat Times

Key points

Four US states have filed lawsuits against TP-Link regarding ISP router vulnerabilities.
The FCC has banned TP-Link from selling its latest routers in the US.
SEC Consult published technical details on the vulnerabilities cited in the complaints.

TP-Link is facing intensified legal and regulatory pressure in the United States, with four states filing lawsuits and the Federal Communications Commission blocking the sale of its newest routers. The company remains unable to sell its latest hardware models domestically until it secures an exemption from the FCC ban, according to Ars Technica.

The legal actions coincide with increased technical scrutiny of the vendor’s equipment. SEC Consult has published detailed technical information regarding the vulnerabilities that were central to the complaints filed by several US states, as reported by SecurityWeek. These disclosures highlight specific security flaws in TP-Link’s ISP routers, providing the technical basis for the allegations made by state authorities.

Regulatory and Legal Context

The FCC’s decision to prohibit the sale of TP-Link’s latest routers represents a significant regulatory hurdle for the manufacturer. According to Ars Technica, the ban prevents the company from distributing these specific devices in the US market. TP-Link is currently seeking an exemption from this prohibition, but the approval has not yet been granted. This regulatory action operates in parallel with the civil litigation brought by state governments, creating a dual-front challenge for the vendor.

The lawsuits filed by four US states allege that TP-Link failed to adequately address security issues within its internet service provider (ISP) routers. SecurityWeek reports that these complaints specifically reference vulnerabilities that have now been detailed publicly. The publication of these technical details by SEC Consult allows security professionals and the public to understand the specific nature of the flaws that prompted the legal action.

Impact on Security Landscape

The combination of state lawsuits and federal regulatory bans underscores growing scrutiny of consumer networking hardware security. The vulnerabilities in question affect ISP-provided routers, which are critical components of home and small business network infrastructure. By publishing the technical specifics, SEC Consult has enabled a clearer understanding of the risks associated with these devices.

For security professionals, the availability of these technical details is crucial for assessing the scope of the issue. The fact that multiple states have coordinated legal action suggests a broad concern regarding the security posture of TP-Link’s equipment. The FCC’s involvement further elevates the stakes, as the agency’s ban directly impacts the commercial availability of the products.

What should you do?

Security professionals should monitor the technical details published by SEC Consult to assess whether their organizations or clients are using affected TP-Link ISP routers. Since the FCC has banned the sale of the latest models, new deployments of this specific hardware in the US are currently restricted. Organizations should review their inventory of TP-Link equipment and check for any available patches or mitigations for the vulnerabilities described in the SEC Consult report. No fix has been confirmed yet in the provided source material.