News Date: 2026-10-09
Legal pressure on TP-Link Systems has expanded after four additional US states filed consumer-protection lawsuits questioning the security claims, corporate disclosures and privacy practices associated with its routers. Florida, Iowa, Montana and Nebraska have joined Texas in taking action against the California-based company.
Security Marketing Becomes a Legal Issue
The complaints allege that TP-Link promoted security capabilities that did not match the risks presented by vulnerable or unsupported products. They also question how the company describes its separation from TP-Link Technologies, the Chinese organization with which it was affiliated before a 2024 restructuring.
Some of the states argue that consumers were not given sufficient information about the potential implications of Chinese intelligence law for data collected through TP-Link applications. However, the complaints do not establish that the Chinese government obtained customer information through the company, and they do not accuse TP-Link of intentionally placing a backdoor in its routers.
TP-Link says the lawsuits are based on false premises. It describes itself as an independent US company, says products for the American market are manufactured in Vietnam and denies sharing customer network data with foreign governments or unauthorized parties.
Newly Detailed Router Vulnerabilities
The dispute coincides with the publication of technical information about five vulnerabilities affecting 65 models in TP-Link's Aginet product family. These devices are generally supplied and maintained by internet service providers.
The most serious weakness, CVE-2025-30237, can allow an unauthenticated attacker with access to the management interface to perform privileged actions. Researchers said the broader vulnerability chain could enable full device compromise and root-level command execution. Fixes exist, but customized ISP firmware may not be available for users to download directly.
Practical Implications
- Consumers should check router applications and management consoles for available firmware.
- Customers using ISP-supplied equipment should ask providers whether patched firmware has been deployed.
- Organizations should replace unsupported routers and block external access to management interfaces.
- Procurement teams should include support periods and vulnerability-response commitments in purchasing decisions.
I believe the larger story is that router security is moving from a technical support concern into consumer law and national policy. Vendors may increasingly have to prove that security claims, update practices and supply-chain disclosures are accurate throughout a product's useful life.