What happened
Four more US states sued router maker TP-Link Systems on 6 October, bringing the total to five after Texas filed a suit in February. Florida, Iowa, Montana and Nebraska allege the Irvine, California company misled buyers about how secure its routers are and how separate it is from China. TP-Link denies the claims and says it will fight them in court.
According to the complaints, TP-Link advertised security it did not deliver. One example cited is the company's HomeShield network protection service, whose web page claimed it covers all security scenarios, wording still live on 9 October. Nebraska is asking for an order requiring TP-Link to tell buyers where its products and parts come from, about its ties to China, and about known vulnerabilities that have been exploited in its devices.
The suits lean on real incidents. The FBI said in April that Russian military intelligence hackers compromised TP-Link routers using a flaw tracked as CVE-2023-50224, changed DNS settings and collected passwords and login tokens. The claim that Chinese state hackers used TP-Link equipment in the Volt Typhoon and Flax Typhoon campaigns rests on 2025 congressional testimony from former NSA cybersecurity director Rob Joyce, whose written remarks cite no source. None of the complaints allege TP-Link built a backdoor, and the one backdoor named, Horse Shell, was placed on its routers by a state-backed hacking group.
TP-Link says routers for the US market are made in Vietnam, that it has given regulators documents supporting that, and that it is an independent US company not controlled by any foreign government. The complaints counter that only 0.5 percent of parts used at the Vietnamese factory, by value, are sourced in Vietnam. The next day, 21 state attorneys general raised TP-Link's bid for approval of new US router models with the FCC.
Why this is a GRC story
Vendor marketing language is becoming an enforcement surface. "Covers all security scenarios" is the kind of claim that sales teams like and legal teams should read twice. Once a state attorney general treats an absolute claim as deceptive, every marketing page and datasheet becomes a place where an overstatement carries legal weight.
Provenance is now a disclosure obligation. Nebraska's requested relief is not about a specific flaw. It asks TP-Link to tell buyers where components come from and what its ownership ties are. That is a supply chain transparency demand pointed at the consumer market, and it arrives just as the Department of Defense has listed the affiliated Chinese entity, TP-Link Technologies, as a Chinese military company.
The evidence base is mixed, and that matters for anyone writing policy. The complaints combine documented exploitation of a real flaw, testimony that cites no source, and a backdoor that a third party placed. Third party risk work depends on separating those categories.
What to watch
Watch what the FCC does with the conditional approval process for new TP-Link models, since a regulatory answer there could move faster than the litigation. Watch also whether other states join, because coordinated state action tends to produce a settlement template around labeling and disclosure that applies well beyond routers.
For teams that buy network gear, list the devices on your edge, check which still receive firmware, and confirm who owns the end of life date.
Attribution: Analysis based on The Hacker News and related public reporting. This article is original commentary, not a repost of the source material.