TP-Link Sued by Four More U.S. States Over Router Security and China Ties

Florida, Iowa, Montana and Nebraska filed consumer-protection lawsuits against TP-Link Systems on October 6, joining Texas in a legal campaign that now spans five states. The suits accuse the company of overstating the security of its products and exaggerating its separation from Chinese parent company TP-Link Technologies, while its Tether, Tapo, Deco and Kasa Smart apps allegedly gather data that could be exposed under Chinese intelligence law. As evidence, the complaints point to real-world attacks, including a Chinese-linked botnet built largely from compromised TP-Link routers and a Russian GRU campaign that exploited CVE-2023-50224 on end-of-life devices, plus end-of-life models like two Archer AX21 versions still marketed as secure. A day later, 21 state attorneys general sent the FCC a letter urging scrutiny of TP-Link's pending router approvals, while researchers at SEC Consult separately disclosed five critical flaws—CVE-2025-30237, CVE-2025-30238, CVE-2025-30239, CVE-2025-30240 and CVE-2025-30241—in roughly 65 ISP-supplied TP-Link models (HomeShield-enabled HB, HX, HC, EB, EC, EX, XC, XX and VX lines), for which fixes are rolling out through internet providers rather than direct downloads.