TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws

Florida, Iowa, Montana, and Nebraska have filed consumer-protection lawsuits against TP-Link Systems, following a similar Texas case from February, alleging the company exaggerated the security of its routers and downplayed its links to China. The complaints cite claims from TP-Link's HomeShield marketing and reference congressional testimony tying TP-Link devices to the Volt Typhoon and Flax Typhoon campaigns, as well as separate botnet and Russian hacking incidents involving the company's hardware. As supporting evidence of ongoing security weaknesses, the lawsuits reference five vulnerabilities — CVE-2025-30237 through CVE-2025-30241 — affecting TP-Link's Aginet-branded mesh systems, routers, and modems, which TP-Link disclosed in August and which SEC Consult researchers detailed this week; the most critical, CVE-2025-30237, lets an unauthenticated attacker on the local network gain full administrative control via an authentication bypass, while others involve privilege escalation, root-level command injection, hardcoded encryption keys exposing credentials, and a USB-based physical attack vector. TP-Link says patches are being rolled out through ISPs, with the process extending into 2026, and has called the lawsuits baseless, even as a coalition of 21 state attorneys general separately pushes the FCC to deny the company's pending approval to sell new router models in the US.