Four States Put TP-Link's Router Security Claims on the Record

TL;DR

• TP-Link Systems is a networking company whose routers, smart-home devices and cameras sit in homes and small offices across the United States, and, according to the state filings, it leads that retail market for Wi-Fi systems and small-office routers.
• On 6 October 2026 the attorneys general of Florida, Iowa, Nebraska and Montana filed separate consumer protection suits accusing the company of misleading buyers about how secure its routers are and about how separate its US business is from its China-based operations.
• TP-Link's answer arrived the same day: a statement that calls the coordinated lawsuits built on false premises, says devices sold in the US are manufactured in Vietnam, and describes the company as independent of any foreign government.
• The part a buyer can act on is already in the complaints, whatever the outcome: Florida's filing names older models including the TL-WR940N, Archer C7 and Archer AX21, some of which no longer receive security updates or support automatic firmware updates.
• Nebraska's attorney general puts TP-Link's share at no less than 60 percent of the US retail market for Wi-Fi systems and small-office routers, which is how one vendor's firmware support policy comes to govern a very large installed base.
• The next day, 21 state attorneys general asked the FCC to address those China ties before ruling on TP-Link's request for conditional approval of new router models, so the vendor-risk checklist for network gear keeps mattering whatever a court decides.

The complaints in the states' own words

The four filings land on the same day and make the same two allegations in different legal language: that the company overstated how secure its routers are, and that it understated how much of its research, development and manufacturing still depends on China. Florida's attorney general, James Uthmeier, alleges that the company misled consumers. The complaint seeks penalties of up to $10,000 per willful violation, rising to $15,000 where the violation targets seniors, people with disabilities, service members or veterans.

Capture of the official Nebraska Attorney General release (ago.nebraska.gov, published 6 October 2026, captured 13 October 2026): the market share figure, the supply chain allegations and the penalties sought.

Nebraska's release supplies the most quotable number in the set: TP-Link controls at least 60 percent of the US retail market for Wi-Fi systems and small-office/home-office routers. The same release argues that a vast majority of components at the company's Vietnam plant are imported from or through China, that a contractor with ties to the Chinese military built that plant, and that China's 2017 National Intelligence Law requires Chinese citizens to provide necessary support, assistance and cooperation to national intelligence agencies on request.

Iowa's release sets out the security question directly: it says TP-Link "repeatedly claims that its routers are safe and secure", quoting product claims such as "secure Wi-Fi access for guests", "Refined Password Security" and a "New Level of Cyber Security". Its filing also leans on federal material. It cites the Federal Communications Commission's Public Safety and Homeland Security Bureau warning that compromised routers can enable in-depth network surveillance, data exfiltration, botnet attacks and unauthorised access to government or business networks, and it cites National Security Agency and Microsoft reporting on TP-Link routers whose vulnerabilities were exploited by Chinese state hackers. Florida's complaint adds the specific models, and Ars Technica records the detail that carries the most practical weight: older versions of the TL-WR940N, Archer C7 and Archer AX21 appear in the filing, some of which no longer receive security updates or do not support automatic firmware updates.

Capture of the official Iowa Attorney General release (iowaattorneygeneral.gov, published 6 October 2026, captured 13 October 2026): the claims under the Iowa Consumer Fraud Act and the federal warnings the office cites.

TP-Link's answer: a US company with Vietnam assembly

The vendor response came the same day, dated Irvine, California, and written in the flat register companies use when litigation is live. Steve Kovsky, the company's corporate affairs officer, called the coordinated lawsuits built on false premises and said they do nothing to advance national security while unfairly penalizing an industry-leading US company. The statement asserts that for months the company has provided state regulators with documentation showing that devices sold in the US are manufactured in Vietnam and that TP-Link Systems is an independent US company not owned or controlled by any foreign government.

The rebuttal also addresses data handling directly: the statement says the company does not and will not share customer network data with foreign governments or unauthorised third parties, and that claims its products present a threat to user security are baseless. It also says the company performs comprehensive security testing and relies on trusted third-party security labs for additional scrutiny, that it complies with US privacy and data protection laws, and that it meets or exceeds industry best practices for monitoring and preventing vulnerabilities. It closes by committing to refute the allegations in court.

Capture of the vendor's official statement (tp-link.com/us/press, published 6 October 2026, captured 13 October 2026): the corporate affairs response to the four state lawsuits.

Read against the complaints, the disagreement turns on three factual questions: whether the security claims hold up, where the components come from and what the corporate relationship actually is. All three matter to a security decision, and none is settled by a press release or by a complaint. That is the nature of litigation filed under consumer protection statutes, where the state has to show that a representation was misleading.

The firmware support question a small business can act on

One detail in the Florida complaint stands apart from the outcome of the case: the models it names and their support status are facts a buyer can verify today. Ars Technica reports that the cited models include older versions of the TL-WR940N, Archer C7 and Archer AX21, some of which no longer receive security updates or do not support automatic firmware updates. A device that cannot update itself keeps whatever vulnerabilities it shipped with, and it does so in a category of hardware that a small business rarely inventories.

An unpatched router on a small-office network is a network-wide problem, because the router sees every flow that leaves the site. It also holds the credentials for the connection to the internet provider and, on many models, the management surface for Wi-Fi and guest access. The firmware lifecycle of that device belongs on the same asset list as the servers, even where nobody owns it explicitly.

Netics editorial diagram from the state filings: the market share figure the Nebraska and Iowa complaints attribute to TP-Link Systems.

The operational rule that follows is simple enough to apply this quarter: for every router on a site, record the model, the firmware version and the date of the last vendor release, then replace or isolate anything the vendor no longer maintains. Where gear sits on a guest network or a segmented VLAN, the exposure shrinks, and the replacement decision becomes less urgent.

What a 60 percent market share changes about the analysis

Scale is the reason a single vendor's support policy becomes a public question. The Nebraska release states that TP-Link controls at least 60 percent of the US retail market for Wi-Fi systems and small-office/home-office routers, and Iowa's release, on a different scope, says TP-Link controls 60 percent of the American market for network devices like routers. When one vendor holds that share, a change in its firmware policy reaches a large part of the market at once, including sites that never made an explicit purchasing decision about security.

The regulatory layer compounds it. Ars Technica reports that the suits followed a Federal Communications Commission ban on consumer-grade routers produced wholly or partly outside the United States, and the Nebraska release on the coalition letter quotes the FCC Public Notice of 23 March 2026, which calls routers the key networking device that enables American homes, schools, businesses, critical infrastructure providers and emergency services to connect to the internet. On 7 October, 21 state attorneys general led by Nebraska wrote to the FCC about TP-Link's request for conditional approval to sell new router models in the United States, arguing that its ties to China create security concerns that must be addressed before the FCC decides on that request. Compliance questions now attach to the product category itself, which changes what a procurement decision covers.

Netics editorial diagram quoting the vendor statement published on 6 October 2026, with attribution to TP-Link Systems Inc.

For an SME outside the United States, the reading is narrower and still useful. Vendor identity and jurisdiction show up in the threat model, in the update process and in how quickly a support commitment can be verified. The practical approach treats those as questions to answer with evidence before purchase.

A vendor-risk checklist for network gear

Five questions cover most of the exposure, and each has a verifiable answer. Which firmware version does this model run, and what is the vendor's published end-of-support date? Does the device update its firmware automatically, and can that process be verified on the network? Where is the vendor incorporated, and which jurisdiction governs its data handling obligations? Which third party has reviewed the product, and is the review published? What is the replacement path if support ends this year?

Two of those questions change the outcome immediately, and neither requires a legal finding. A device with a published end-of-support date lets a buyer plan a replacement budget. A device that cannot update its own firmware moves to a segmented network until it is replaced, because segmentation limits what a compromised router can reach.

Teams that want an evidence-based assessment can pair this with a security audit and hardening pass over the perimeter, and the earlier review of what the 2026 State of Open Source in Europe report measured shows how much of this ground is now a matter of published numbers.

Originally published on the Netics blog.