In the first week of October, attorneys general in Florida, Iowa, Montana, and Nebraska filed lawsuits against TP-Link Systems, the company behind a large share of the WiFi routers sold in American stores. Texas sued the same company back in February. A 21-state coalition of attorneys general has also asked the FCC to keep scrutinizing the brand.

If you're running a TP-Link, Deco, or Tapo device right now, none of this means your router is compromised tomorrow. It does mean five state governments allege in court that the company has been telling you its routers are safer than they are, and two federal agencies have already restricted the company's ability to sell new models here. That combination is worth five minutes of your attention.

What the states actually allege

These are consumer-protection lawsuits, and the complaints are public. A few of the claims, from the filings and the reporting around them (Ars Technica, SecurityWeek, Bloomberg):

About 6 in 10 routers on American shelves. The Montana complaint says TP-Link controls at least 60% of the US retail WiFi and SOHO router market. That's why regulators care: it's the brand on most American store shelves.

Security claims the lawsuits call deception. TP-Link's HomeShield subscription was advertised as covering "all security scenarios", and one support statement promised a "100% safeguard" — a quote dating from November 2025, after multiple exploited vulnerabilities in TP-Link firmware were already public.

The Vietnam manufacturing story. To dodge tariffs and scrutiny, TP-Link built a factory in Vietnam. A Bloomberg investigation, reported by Ars Technica, in April 2025 found only about half a percent of that plant's components by value are actually sourced in Vietnam. Montana's Department of Justice put the workforce at roughly 11,000 employees in China versus about 300 in the US. Florida's attorney general called the corporate separation "fiction".

Data terms. The mobile apps collect email, location, and device identifiers, and reserve the right to share them with unnamed "affiliates." Under China's 2017 National Intelligence Law, a Chinese company can be compelled to assist state intelligence work, and a 2021 rule requires Chinese companies to report discovered vulnerabilities to their government within two days. Those legal realities sit in the background of every "affiliate" clause.

The security record the states cite

The lawsuits don't just argue about marketing. They list specific incidents:

The rule hitting store shelves

The regulatory angle is bigger than the lawsuit itself. The FCC's own covered list (checked October 2026) shows what happens to vendors that don't pass a national-security review: in March, the agency banned newly produced foreign-made consumer routers from US sale unless the vendor is approved. Twenty-two vendors have conditional approvals so far, including Netgear, Asus, and Amazon's eero line. TP-Link is not among them. New TP-Link router models can't be sold in the US right now, while existing inventory and firmware updates for current devices continue into 2029.

That means the stores still selling TP-Link are mostly working through stock, and the company has real pressure to change how it operates, or how it describes itself.

What I'd actually do

I work in home networks for a living, so I'll be plain about it: no one needs to panic-buy hardware. But there are three sensible lanes, depending on your situation.

Lane one: harden what you have. Today: update the router's firmware to its newest version, change the admin password if it's still the default, and turn off remote administration unless something on the network needs it. Those three steps cover the majority of what attacks actually use, regardless of the brand on the box. Check whether your internet provider supplied your router. If it did, call them and confirm their equipment got the latest fix, because ISP-distributed gear is often behind on patches.

Lane two: reflash an older router instead of tossing it. If you have an abandoned router that no longer gets updates, open-source firmware called OpenWrt can breathe new life into it. OpenWrt is community-maintained software that replaces the manufacturer's firmware entirely: no vendor cloud, no app calling home, and deep control over the firewall, device isolation, and DNS. It's free, it's audited in public, and support continues long after the vendor quits. Check the supported hardware list before touching anything.

The honest limits: not every router model is compatible, some (including most ISP-customized or "internet provider" models) never will be, and the setup is technical, with a genuine brick-the-paperweight risk on unsupported hardware. The software itself has no such corporate issue, but the hardware inside is still made abroad, which is worth knowing given the new FCC rules.

Lane three: replace deliberately. If your router is years old, unpatched, or you want to stop worrying about it, replace it. A few references from vendor sites, current as of October 2026:

The common thread: pick gear whose update story you actually know, and put someone on the hook for keeping it current.

The part worth repeating

The lawsuits do not prove every TP-Link device is compromised. TP-Link calls the claims baseless and says its products are safe. Both of those things can be true and you'd still be better off doing the lane-one checklist this weekend, because a router with a fresh password, current firmware, and remote administration off is dramatically harder to abuse than a default one, whatever the logo on it says.

If you run a business and can't afford a dead network afternoon, that's exactly when a managed swap-out makes sense: someone handles firmware, isolation, and monitoring while you sell things. If you ever need a hand, just reach out.

Paul Hall runs The Fiber Dad, a home IT and network security service in the Knoxville area.