States Allege TP-Link Misled Consumers on Router Security
The attorneys general of Florida, Iowa, Montana, and Nebraska filed lawsuits against TP-Link Systems on October 6 in their respective state courts, alleging the company misled consumers about the security of its routers and its connections to China. The complaints, which are nearly identical, rely on each state’s consumer protection laws and follow a similar lawsuit filed by Texas in February. The states argue that TP-Link’s marketing overstated the protection provided by its devices, specifically citing claims that the HomeShield service "covers all security scenarios" and, as recently as November 2025, offered a "100% safeguard."
To support these allegations, the states point to congressional testimony showing that TP-Link routers were exploited in the Volt Typhoon and Flax Typhoon cyber campaigns attributed to Chinese threat actors. They also reference botnets used by these actors for password spraying attacks and note that Russian hackers have similarly targeted TP-Link routers. According to the complaints, several of the exploited router models do not support automatic firmware updates and no longer receive security updates, leaving users vulnerable.
Lawsuits Challenge TP-Link’s Claims of Separation from China
The states further challenge TP-Link’s asserted separation from China, alleging that much of its research, development, and manufacturing remains based there. They claim that only 0.5% of the components used at TP-Link’s Vietnam factory, by value, are sourced locally in Vietnam. The complaints also argue that TP-Link’s privacy policies fail to disclose that its Chinese affiliates are subject to China’s Intelligence Law, which could compel data sharing with the government. Additionally, the states say TP-Link does not inform users about 2021 Chinese regulations requiring newly discovered vulnerabilities to be reported to the government before public disclosure.
The lawsuits seek injunctions, civil penalties, and the return of money obtained through alleged violations, and request jury trials. The states aim to halt what they describe as deceptive practices that put consumers at risk while benefiting from misleading claims about product security and foreign influence.
SEC Consult Details Five Critical Vulnerabilities in TP-Link ISP Routers
To demonstrate that TP-Link’s security problems are ongoing, the complaints cite five vulnerabilities disclosed by the company in August, tracked as CVE-2025-30237 through CVE-2025-30241. These flaws affect TP-Link’s Aginet line of ISP-managed mesh systems, routers, and modems. SEC Consult, the research firm that discovered the vulnerabilities, published technical details on Thursday, stating that the bugs allowed an unauthenticated attacker on the same network to fully compromise affected devices.
The most severe flaw, CVE-2025-30237, is an authentication bypass in the device’s web server. An attacker with access to the web interface could exploit it to create a super-administrator account and enable SSH access without needing any credentials. CVE-2025-30238 allows a low-privileged user to perform actions reserved for administrators. CVE-2025-30241 is a command injection vulnerability in the web interface that lets an authenticated attacker execute commands with root privileges.
CVE-2025-30239 arises from the use of hardcoded encryption keys tied only to the device model to protect configuration files and backups. An attacker who obtains these files and extracts the keys from the firmware could recover user passwords, Wi-Fi credentials, and, depending on the configuration, credentials used for remote management by the ISP. The fifth vulnerability, CVE-2025-30240, requires physical access: an attacker could plug in a specially prepared USB drive to read the device’s entire file system.
TP-Link identified 65 affected devices, including mesh systems, routers, fiber (PON) devices, and DSL modems, noting that ISP-customized variants of these models are also impacted. SEC Consult began reporting the flaws to TP-Link in December 2024. The vendor said in January 2025 that the initial issues were fixed, but identifying all affected models took until July 2025. The rollout of fixes, including custom firmware for affected ISPs, extended into 2026. TP-Link states that firmware updates for affected devices are distributed by ISPs and advises users to check their device’s management interface or app for updates, or contact their ISP if none are available. SEC Consult did not release proof-of-concept exploit code due to concerns that many vulnerable devices remain unpatched.
TP-Link Rejects Allegations as Baseless
In an October 6 statement, TP-Link rejected the lawsuits, calling them "built on false premises" and claiming they "do nothing to advance national security while unfairly penalizing an industry-leading U.S. company." Steve Kovsky, TP-Link’s corporate affairs officer, said the company had spent months providing state regulators with documentation showing that its U.S.-sold devices are manufactured in Vietnam and that it is not owned or controlled by any foreign government.
TP-Link asserted that "any claims that our products present a threat to user security or grant unauthorized network access to foreign governments are baseless." On October 7, Montana Attorney General Austin Knudsen joined a coalition of 21 state attorneys general in a letter urging the FCC to scrutinize TP-Link. The company is seeking conditional approval to sell new router models in the U.S. after the FCC moved in March to add routers produced in foreign countries to its Covered List. Knudsen said, "TP-Link routers should be considered a Trojan horse planted by the Chinese Communist Party to spy on Americans. I hope the FCC seriously considers TP-Link’s concerning practices and declines to grant the conditional approval they are seeking for the sake of our national security."
Source: SecurityWeek