Four additional U.S. states filed lawsuits against router manufacturer TP-Link Systems on October 6, joining Texas in legal action that claims the California-based company misled consumers about its products' security and independence from China, according to The Hacker News. Florida, Iowa, Montana, and Nebraska brought the complaints in state courts under consumer-protection statutes, alleging TP-Link overstated the safety of its routers and understated its connections to Chinese operations. TP-Link, headquartered in Irvine, California, denies all allegations and says it will challenge the suits in court.

The complaints make three central accusations. First, they claim TP-Link advertised security capabilities it failed to deliver, citing the company's HomeShield service page, which stated it "covers all security scenarios" as of October 9, even as some router models no longer receive security updates. The Archer AX21, for instance, reached end of life in May 2024 and no longer gets fixes, according to the complaints. Second, the states argue TP-Link exaggerated its separation from TP-Link Technologies, a Chinese firm, after a 2024 restructuring. The suits note that together, the two entities employed roughly 11,000 workers in China as of an April 2025 Bloomberg report. While TP-Link says U.S.-market routers are manufactured in Vietnam, only 0.5% of components used at its Vietnamese facility, by value, come from Vietnam itself—the remainder are sourced from or through China, the complaints state. Third, the states allege TP-Link's privacy disclosures omit a key risk: that a 2017 Chinese intelligence statute could give Chinese agencies access to data collected by the company's Tether, Tapo, Deco, and Kasa Smart apps, which gather email addresses, location information, and phone identifiers. Florida seeks a permanent injunction, disgorgement of profits, and $10,000 per willful violation, while Montana and Nebraska request similar penalties and disclosure requirements.

TP-Link corporate affairs officer Steve Kovsky called the coordinated lawsuits "built on false premises" in a statement issued the day they were filed. The company said it has provided state regulators with documentation for months showing its U.S. devices are made in Vietnam, and described itself as "an independent, U.S. company that is not owned or controlled by any foreign government," adding that it does not and will not share customer network data with foreign governments or unauthorized parties. The complaints reference real cyberattacks in which hackers commandeered TP-Link routers, including a 2024 Microsoft report that found TP-Link devices "make up most of" a network of compromised small-office and home routers averaging 8,000 active hacked devices at any time, used for password-spray attacks by a group Microsoft believes operates from China. Separately, the FBI said in April that Russian military intelligence hackers exploited a flaw tracked as CVE-2023-50224 to compromise TP-Link routers, alter DNS settings, and steal passwords and login tokens. The states also cite testimony from former National Security Agency cybersecurity director Rob Joyce, who told a House committee in 2025 that TP-Link routers "were among the various brands" exploited in the Volt Typhoon and Flax Typhoon campaigns, though TP-Link disputed that claim the same day, saying those operations "have no discernible preference for using TP-Link routers as a vector."

On October 7, one day after the lawsuits were filed, 21 state attorneys general sent a letter to the Federal Communications Commission regarding TP-Link's pursuit of conditional approval for new router models under a March 23 rule that bars new foreign-made consumer routers from equipment authorization unless they receive such approval from the Department of Homeland Security or Department of Defense. The letter, led by Nebraska Attorney General Mike Hilgers and signed by 20 others, raises the same three concerns as the lawsuits—security claims, separation from China, and privacy-disclosure gaps—and offers to work with the FCC, though it does not explicitly request denial or delay of approval. The complaints also highlight five flaws in TP-Link's Aginet line of ISP-supplied mesh systems, routers, and modems, disclosed by TP-Link on August 10 and detailed publicly by SEC Consult researchers on October 8. Together, the vulnerabilities allowed an unauthenticated attacker on the same network to fully compromise affected devices and execute commands with root-level privileges, with the main flaw, CVE-2025-30237, rated 8.7 out of 10 and enabling privileged web-interface actions without login. TP-Link lists 65 affected models, and fixes are delivered through each internet service provider rather than direct downloads, meaning owners may not be able to update devices themselves. SEC Consult reported the flaws to TP-Link in December 2024, and most fixed firmware had been released by February 2026, though neither advisory reports attacks exploiting these specific vulnerabilities or ties them to the allegations about China. The legal and regulatory pressure signals a sharpening focus on supply-chain transparency and the credibility of corporate assurances in sectors where trust is non-negotiable. For vendors caught between geopolitical scrutiny and consumer expectations, the gap between technical compliance and public confidence may prove harder to bridge than any vulnerability patch.