Four US states have sued TP-Link Systems, accusing the router maker of misleading consumers about the security of its products and its ties to China.
The attorneys general of Florida, Iowa, Montana, and Nebraska filed the lawsuits on October 6 in their respective state courts. Each relies on its state’s consumer protection laws. Texas filed a similar lawsuit against the company in February.
The new state complaints, which are nearly identical, argue that TP-Link’s marketing overstates the protection its devices provide. They single out claims that the company’s HomeShield service “covers all security scenarios” and, as recently as November 2025, offered a “100% safeguard.”
To counter those claims, the states cite congressional testimony that TP-Link routers were exploited in the Volt Typhoon and Flax Typhoon campaigns. They also point to botnets used by Chinese threat actors for password spraying attacks, and to Russian hackers targeting TP-Link routers.
According to the complaints, several of the exploited models do not support automatic firmware updates and no longer receive security updates.
The states also take aim at TP-Link’s claimed separation from China. They allege that much of its research, development, and manufacturing remains there, and that only 0.5% of the components used at its Vietnam factory, by value, are bought in Vietnam.
The complaints further claim that TP-Link’s privacy policies do not disclose that its Chinese affiliates are subject to China’s intelligence law. The states also say TP-Link fails to disclose 2021 Chinese regulations that require newly discovered vulnerabilities to be reported to the government.
The complaints seek injunctions, civil penalties, and the return of money obtained through the alleged violations, and request jury trials.
SEC Consult details ISP router flaws named in the complaints
To show that TP-Link’s security problems persist, the complaints cite five vulnerabilities, tracked as CVE-2025-30237 through CVE-2025-30241, that TP-Link disclosed in August. The issues affect the company’s Aginet line of ISP-managed mesh systems, routers, and modems.
On Thursday, SEC Consult, whose researchers discovered the flaws, published technical details.