WASHINGTON — The legal and regulatory battle surrounding major network equipment manufacturer TP-Link Systems escalated dramatically as four additional U.S. states filed lawsuits against the California-based router maker. The aggressive legal actions center on allegations that the company severely misled American consumers regarding the robust nature of its device security, downplayed its operational and corporate ties to China, and exposed millions of connected households to systemic cyber vulnerabilities.

With Florida, Iowa, Montana, and Nebraska joining an initial February lawsuit filed by Texas, TP-Link now faces coordinated multi-state prosecution. Simultaneously, a bipartisan coalition of 21 state attorneys general has petitioned federal regulators to scrutinize the company’s pending market authorizations, compounding pressure on a hardware giant that currently anchors a significant share of the American consumer networking market.

Main Facts

The core of the legal conflict rests on a web of consumer protection lawsuits filed in state courts by attorneys general across the country. The complaints target TP-Link Systems, a U.S.-registered entity headquartered in Irvine, California, which underwent a corporate restructuring in 2024 to distance itself from its historical affiliate, TP-Link Technologies, a Chinese corporate entity. Despite these structural changes, state prosecutors argue that the company remains fundamentally tied to Chinese supply chains and subject to foreign statutory mandates that compromise user data privacy.

The multi-state litigation highlights three central accusations against TP-Link:

1. Misleading Security Assurances: The lawsuits allege that TP-Link marketed its built-in network security features—such as its proprietary "HomeShield" software—as comprehensive protections covering "all security scenarios," while simultaneously selling hardware that ultimately went unpatched or reached its end-of-life cycle with known, exploitable flaws.
2. Obscured Foreign Ties: Prosecutors claim the company heavily overstated the degree of its separation from its Chinese origins. According to supply chain data cited in the suits, while U.S.-bound routers are assembled in a factory in Vietnam, approximately 99.5% of the component parts by value originate from or pass through mainland China.
3. Implicit Data Exposure: The company’s mobile companion apps—including Tether, Tapo, Deco, and Kasa Smart—collect extensive telemetry data, including user email addresses, precise location identifiers, and phone numbers. State complaints argue that under China’s sweeping 2017 National Intelligence Law, this data could theoretically be accessed or subpoenaed by Chinese intelligence agencies.

Furthermore, the legal filings coincide with the public disclosure of five critical vulnerabilities (tracked under CVE-2025-30237 through CVE-2025-30241) affecting dozens of TP-Link mesh systems, routers, and modem variants distributed primarily through Internet Service Providers (ISPs). Although patches have been developed, the presence of these severe security gaps has added immediate ammunition to the arguments presented by state regulators.

Chronology of Events

Understanding the rapid escalation of scrutiny against TP-Link requires examining the timeline of regulatory milestones, geopolitical designations, and cyber threat disclosures:

• December 2024: Independent security researchers at SEC Consult privately disclose five critical vulnerabilities affecting multiple TP-Link device series to the manufacturer.
• February 2025: Texas Attorney General Ken Paxton files the pioneering consumer protection lawsuit against TP-Link, marking the first direct state-level legal challenge regarding the company’s Chinese affiliations and device security framework.
• March 2025: During congressional testimony before a House committee, former National Security Agency (NSA) cybersecurity director Rob Joyce identifies TP-Link routers as hardware frequently exploited by state-sponsored cyber threat actors in campaigns such as Volt Typhoon and Flax Typhoon. TP-Link publicly disputes these claims the same day.
• March 23, 2025 (Policy Shift): The Federal Communications Commission (FCC) implements strict new rules banning unauthorized, foreign-made consumer routers from obtaining market entry approvals in the United States unless granted specific conditional waivers by the Department of Homeland Security or the Department of Defense.
• April 2025: Investigative reporting by Bloomberg highlights that TP-Link and its Chinese affiliates jointly employed roughly 11,000 workers, emphasizing deep historical labor and operational links. The FBI concurrently issues warnings that Russian military intelligence (APT28) has been exploiting legacy TP-Link vulnerabilities (such as CVE-2023-50224) to hijack DNS settings and harvest credentials.
• June 2025: The U.S. Department of Defense formally designates TP-Link Technologies (the Chinese corporate entity) as a Chinese military company, placing it on official restricted lists, though formally distinguishing it from the U.S.-based subsidiary TP-Link Systems.
• August 2025: TP-Link officially issues its security advisory acknowledging the critical vulnerabilities initially reported by SEC Consult, initiating coordinated patch deployments through ISP networks.
• October 6, 2025: A coalition of four additional states—Florida, Iowa, Montana, and Nebraska—simultaneously files coordinated consumer protection lawsuits against TP-Link Systems in their respective state courts.
• October 7, 2025: A bipartisan group of 21 state attorneys general, led by Nebraska Attorney General Mike Hilgers, dispatches a formal warning letter to the FCC, urging federal regulators to closely review and potentially restrict TP-Link’s efforts to win approvals for new router models.
• October 8, 2025: SEC Consult publishes comprehensive technical details regarding the five critical vulnerabilities found in ISP-supplied Aginet and enterprise mesh hardware, noting that full firmware remediation requires manual distribution via individual service providers.

Supporting Data: Vulnerabilities in ISP-Supplied Hardware

The lawsuits leverage concrete technical data regarding hardware vulnerabilities to dismantle TP-Link’s marketing claims of superior network security. Particular emphasis is placed on vulnerabilities discovered in TP-Link’s "Aginet" and standard router/modem lines provided directly to consumers by internet service providers.

Research published by SEC Consult categorizes the flaws as critical, noting that they frequently allow unauthenticated network attackers to achieve remote code execution with root privileges. The following breakdown details the specific Common Vulnerabilities and Exposures (CVEs) cited in the state complaints:

Unlike standard retail hardware where end-users can directly download and apply firmware packages, devices provisioned through ISPs often utilize custom software variants. Consequently, users frequently rely on their service provider to push critical security updates—a process that security researchers note can introduce significant delays in threat mitigation.

Official Responses and Defense Strategies

TP-Link has mounted a vigorous defense against the coordinated legal offensive, characterizing the multi-state lawsuits as politically motivated, legally baseless, and detrimental to market competition.

In an official public statement released immediately following the October filings, Steve Kovsky, TP-Link’s corporate affairs officer, strongly rejected the allegations:

"The coordinated lawsuits are built on false premises. They do nothing to advance national security while unfairly penalizing an industry-leading U.S. company. For months, we have provided state regulators with extensive documentation proving that our U.S. devices are manufactured in Vietnam and that we operate as an independent U.S. company not owned or controlled by any foreign government. We do not, and will not, share customer network data with foreign governments or unauthorized third parties."

The company maintains that its 2024 corporate restructuring established a permanent legal and operational firewall between its U.S. enterprise and its former Chinese counterparts. Furthermore, TP-Link argues that foreign state-sponsored cyberattacks—such as those tracked by Microsoft involving botnets built from small-office and home (SOHO) routers—are an industry-wide challenge impacting all major hardware manufacturers rather than reflecting inherent design malice unique to TP-Link equipment.

Implications for Consumers and the Broader Tech Industry

The convergence of multi-state litigation, bipartisan federal lobbying, and stricter FCC equipment authorization rules signals a transformative shift in how the United States regulates foreign-linked consumer electronics.

1. Supply Chain Realignment

The legal scrutiny directed at TP-Link’s sourcing practices—specifically the revelation that 99.5% of component parts in its Vietnamese assembly plants originate from or route through China—highlights the extreme difficulty electronics manufacturers face in achieving true geographic decoupling. Future regulatory frameworks may establish stricter thresholds for component-level provenance rather than final assembly location.

2. ISP and Consumer Accountability

With millions of active routers deployed across American households, the dependency on ISPs to deliver critical security patches creates a vulnerable window for exploitation. The exposure of hardcoded encryption keys and unauthenticated remote access vectors underscores the urgent need for automated, fail-safe update mechanisms across all consumer-grade networking gear.

3. Regulatory Precedent

If the coalition of state attorneys general successfully utilizes state-level consumer protection statutes to penalize hardware manufacturers over speculative geopolitical risks, it could set a powerful legal precedent. Technology companies selling connected devices in the U.S. may soon face mandatory disclosures regarding data routing jurisdictions, foreign legal exposure under intelligence statutes, and transparent end-of-life support timelines.

As the litigation moves forward in state courts, and as federal agencies weigh the petitions submitted by state regulators regarding new product authorizations, TP-Link faces a pivotal period that will test the resilience of its brand, its supply chain architecture, and its standing in the American market.