FOLLOW US

What TP-Link Owners Need to Know

• The cases cite specific TP-Link router vulnerabilities that federal agencies say were exploited by Chinese and Russian state-backed hackers.
• The states allege TP-Link downplayed continuing China-based operations and links to TP-Link Technologies, which the Pentagon designated a Chinese military company in June.
• Owners should identify their exact router model and hardware version, install current firmware, and replace equipment that has reached end-of-support.

By Samuel López | USA Herald

The lawsuits filed Tuesday against TP-Link are more serious than a fight over where a router was assembled. Florida, Iowa, Montana and Nebraska allege that TP-Link Systems Inc. sold Americans devices advertised as secure while failing to adequately disclose known security flaws, continuing ties to China and the risks created by Chinese intelligence laws. These are four separate state cases, not a single multistate complaint.

At least one state had been digging into TP-Link for months. Florida Attorney General James Uthmeier opened a formal consumer-protection investigation and served the company with a subpoena on Dec. 2, 2025, demanding records concerning its corporate structure, software development, manufacturing, handling of consumer data and evidence supporting its security claims. The complaints also rely on TP-Link's own product statements and security notices, federal vulnerability records, Microsoft threat intelligence, FBI and NSA findings, congressional testimony and Pentagon records. My Florida Legal

The allegations are unusually specific. Nebraska's complaint says the TL-WR940N was affected by CVE-2023-50224, which was exploited by the China-linked Quad7 network and Russia's GRU. Versions of the Archer AX21 contained CVE-2023-1389, allowing an attacker without the router password to inject commands. More recent allegations include CVE-2025-30237, which could permit an unauthenticated attacker with network access to bypass login protections on certain Aginet devices, and CVE-2026-9254, which allegedly allowed command execution with root privileges on several Archer models. Nebraska Attorney General

These are not merely hypothetical attack techniques. In April, the NSA said Russia's GRU had compromised TP-Link routers using CVE-2023-50224 to steal sensitive information. Separately, the Justice Department previously disrupted a China-linked Flax Typhoon botnet containing more than 200,000 compromised consumer devices from multiple manufacturers. Federal investigators found the group had successfully attacked corporations, universities, government agencies, telecommunications providers and media organizations. That does not, however, establish that every compromised device was TP-Link or that the new state complaints have identified a particular household whose information was transferred to the Chinese government. NSA

The company at the center of the China allegations is TP-Link Technologies Co., Ltd. TP-Link Systems says it separated from that China-based business in 2024. The states contend the separation did not eliminate material Chinese connections because research, development, suppliers and manufacturing operations remain there. More significantly, the Pentagon's June 2026 Section 1260H determination listed TP-Link Technologies as a Chinese military company, stating it is “directly affiliated with the PLA” and had received Chinese government assistance connected with military-industrial planning. Nebraska Attorney General

TP-Link rejects the accusations. The California-headquartered company called the lawsuits “built on false premises,” says U.S.-market devices are manufactured in Vietnam, says it is an independent American company not controlled by a foreign government, and says it does not share customer network data with foreign governments. TP-Link

California Attorney General Rob Bonta is conspicuously absent despite TP-Link Systems being based in Irvine. As of publication, USA Herald found no public explanation from Bonta's office for why California did not join Tuesday's cases. Without one, assigning a political or investigative reason would be speculation.

There is no question about the requested remedy. Nebraska seeks a permanent injunction, consumer restitution, civil penalties and court-ordered disclosures concerning China ties and known exploited vulnerabilities. Montana likewise seeks a permanent injunction. The verified Nebraska caption is State of Nebraska, ex rel. Michael T. Hilgers, Attorney General v. TP-Link Systems Inc., District Court of Keith County, Case No. D68CI260000109. Nebraska Attorney General

Read the official Nebraska complaint
Read the official Iowa petition

Consumers do not need to guess what equipment they own. Check the label on the bottom or back of the router for TP-Link, the model — such as Archer AX21, Archer C7 or TL-WR940N — and the hardware version. Then check TP-Link's security advisories and end-of-life list for that exact version. Federal agencies recommend installing the latest firmware, changing default administrator credentials, disabling internet-facing remote management and replacing routers that no longer receive security updates. For ISP-provided equipment, customers should ask the provider whether their exact model is affected and still supported. Nebraska Attorney General

About the Author

Samuel López is a reporter and news correspondent for USA Herald who has reported for the publication since 2022. López is also a seasoned legal professional with more than two decades of experience analyzing state and federal litigation, evidence, regulatory issues and complex legal matters. His legal-analysis background informs his reporting on lawsuits where the allegations in a complaint must be separated from facts independently established by government agencies and other evidence.

Stay Informed Beyond the Headlines

If this report gave you details you were not seeing elsewhere, join readers who follow USA Herald for investigative reporting, legal analysis, cybersecurity and national-security coverage that goes beyond the headline. Subscribe to the USA Herald newsletter

👉 Follow USA Herald on X @RealUSAHerald