Mounting Pressure: Five U.S. States Sue Router Giant TP-Link Over Security and China Ties

The landscape for networking hardware giant TP-Link Systems has grown increasingly hostile as a coalition of U.S. states escalates its legal and regulatory campaign against the company. On October 6, four additional states—Florida, Iowa, Montana, and Nebraska—filed lawsuits against the Irvine, California-based manufacturer, joining Texas, which initiated its own legal action in February. This multi-front litigation accuses TP-Link of deceptive trade practices, alleging that the company misled American consumers regarding the security of its hardware and the extent of its operational independence from China.

The lawsuits, filed under various state consumer-protection statutes, represent a significant escalation in the ongoing debate regarding foreign-made infrastructure and national security. While TP-Link maintains that these allegations are built upon false premises, the combined legal, political, and technical scrutiny poses a formidable challenge to the company’s standing in the U.S. market.

The Core Allegations: Misleading Security and Foreign Ties

The litigation centers on three primary arguments that the state attorneys general believe demonstrate a pattern of corporate deception.

First, the states argue that TP-Link marketed its products—specifically its "HomeShield" network protection suite—as providing comprehensive, high-level security that the hardware failed to deliver. The complaints highlight instances where routers were successfully compromised by state-backed actors or reached "end-of-life" status without receiving necessary security patches, directly contradicting marketing materials claiming that HomeShield "covers all security scenarios."

Second, the plaintiffs challenge the narrative of TP-Link’s restructuring. While the company claims to be an independent U.S. entity, the lawsuits point to its deep-seated history with its former parent firm, TP-Link Technologies, a Chinese company. Despite a 2024 corporate reorganization, the states allege that the "entirely different ownership, management, and operations" touted by TP-Link are, at best, superficial. Data cited in the complaints—including a Bloomberg report from April 2025—notes that the two entities combined employed approximately 11,000 people in China. Furthermore, the states emphasize that while TP-Link routers for the U.S. market are assembled in Vietnam, an overwhelming 99.5% of the component value is sourced from or routed through China.

Third, the lawsuits contend that TP-Link’s privacy policies are fundamentally opaque regarding the risks posed by Chinese intelligence laws. Apps such as Tether, Tapo, Deco, and Kasa Smart collect sensitive user data, including email addresses, geolocation, and device identifiers. The states argue that under the 2017 Chinese National Intelligence Law, this data could theoretically be compelled for disclosure to Chinese intelligence agencies, a risk the plaintiffs argue is never adequately disclosed to the end-user.

Chronology of Escalation

The friction between TP-Link and U.S. authorities has been building for years, culminating in the current legal crisis.

• February 2026: Texas Attorney General Ken Paxton files the first major lawsuit against TP-Link, setting the precedent for the current wave of litigation.
• March 2026: The Federal Communications Commission (FCC) implements a strict ban on new foreign-made consumer routers, requiring "Conditional Approval" from the Department of Homeland Security or the Department of Defense to enter the U.S. market.
• April 2026: TP-Link asserts that its existing routers remain fully authorized and confirms it is seeking the required Conditional Approval for new product lines.
• June 2026: The U.S. Department of Defense officially designates TP-Link Technologies (the Chinese entity) as a "Chinese military company," further heightening the stigma surrounding the brand.
• October 6, 2026: Florida, Iowa, Montana, and Nebraska join the legal fray, filing coordinated complaints that mirror the arguments established in the Texas suit.
• October 7, 2026: A coalition of 21 state attorneys general writes to the FCC, expressing deep concerns regarding TP-Link’s attempts to secure approval for new models and urging the commission to consider the potential security risks.
• October 8, 2026: Security researchers at SEC Consult publish technical details regarding five critical vulnerabilities identified in TP-Link’s Aginet series, which are widely deployed by internet service providers (ISPs).

Technical Vulnerabilities: The Aginet Controversy

While the lawsuits focus on broad corporate conduct, the technical reality of TP-Link’s hardware has provided the plaintiffs with tangible evidence of security lapses. The "Aginet" line, a series of routers, modems, and mesh systems provided by ISPs, was found to harbor five critical vulnerabilities (CVE-2025-30237 through CVE-2025-30241).

These flaws, disclosed by SEC Consult, allow an unauthenticated attacker on a local network to achieve "root" access—the highest level of administrative control. One of the most severe flaws, CVE-2025-30237, allows an attacker to bypass login requirements entirely to create a "Superadmin" account. Another, CVE-2025-30239, enables the decryption of stored passwords because the encryption keys are hardcoded into the firmware per model.

The discovery of these flaws highlights a precarious supply chain issue for consumers. Because these devices are provided by ISPs, users often cannot manually update their own firmware. Instead, they must wait for the ISP to push the update, which may be delayed or unavailable if the ISP has customized the device software. Although patches for most of these vulnerabilities were released by early 2026, the long delay between discovery and resolution—nearly 20 months in some cases—has become a cornerstone of the states’ argument that TP-Link’s security practices are insufficient.

Official Responses and Defensive Posture

TP-Link has mounted a robust defense, characterizing the litigation as a coordinated, politically motivated attack. Steve Kovsky, the company’s corporate affairs officer, stated that the lawsuits are built on "false premises" and do nothing to improve national security, instead serving only to "unfairly penalize an industry-leading U.S. company."

The company maintains that it has provided extensive documentation to state regulators proving that its U.S.-bound devices are manufactured in Vietnam and that it operates independently of any foreign government. "We do not, and will not, share customer network data with foreign governments or unauthorized third parties," Kovsky stated.

Regarding the specific allegations of state-sponsored exploitation, TP-Link has frequently pushed back against reports from entities like Microsoft and individual testimonies. When former NSA official Rob Joyce testified before the House that TP-Link routers were used in campaigns like "Volt Typhoon," the company issued a sharp rebuttal, claiming that these threat actors show no discernible preference for TP-Link hardware over other brands.

Broader Implications for the U.S. Market

The ramifications of this legal battle extend far beyond the courtroom. For the average consumer, the conflict signals a shift in the regulatory environment surrounding the "Internet of Things" (IoT). The 21-state letter to the FCC suggests a new paradigm where state-level officials are no longer waiting for federal guidance to challenge the security posture of global technology firms.

For ISPs, the situation is equally complex. With many providers relying on TP-Link’s Aginet series for their residential deployments, any potential FCC-mandated restrictions on new TP-Link hardware could force a massive, costly overhaul of network infrastructure.

The lawsuits also highlight the "gray area" of modern manufacturing. As the states point out, relying on a company for security when 99.5% of its component parts are sourced from a country deemed a strategic adversary creates a supply chain vulnerability that is difficult to mitigate through software patches alone. Whether or not the states succeed in their demand for damages—which include $10,000 per violation—the narrative of "foreign risk" has become a permanent feature of the discourse surrounding TP-Link.

As the case proceeds, the focus will likely remain on the tension between globalized supply chains and the increasing demand for "sovereign" hardware security. For now, TP-Link remains a market leader, but the mounting pressure from state attorneys general and the regulatory hurdles at the FCC suggest that the company’s future in the United States will be defined as much by its legal battles as by its routers.