FCC Adds Foreign-Made Routers to Covered List, Restricting New U.S. Authorizations
Summary
The FCC added foreign-produced routers to its Covered List, restricting new U.S. equipment authorizations absent security review. Existing authorized devices remain usable, and firmware updates are permitted through at least March 1, 2027.
Key points
- The FCC’s update followed a National Security Determination received March 20 from a White House-convened interagency body.
- The determination cited supply-chain risks to critical infrastructure and national defense; the FCC cited Volt Typhoon, Flax Typhoon, and Salt Typhoon campaigns.
- New foreign-produced router models generally cannot receive FCC equipment authorization unless they pass a security review by the Department of Defense or Department of Homeland Security.
- A Conditional Approval path requires manufacturers to commit to establishing or expanding U.S. manufacturing for the products they seek to bring to market.
- Existing authorized routers can remain in use and can continue to be sold from existing supply chains; firmware updates are permitted through at least March 1, 2027.
- The article notes that researchers questioned the policy’s near-term security impact, saying the cited Volt Typhoon attacks primarily targeted Cisco and Netgear hardware and pointing to software patching failures.
Article Details
- Event Type
- FCC restriction on new authorizations for foreign-produced routers
- Impact
- The FCC added all routers produced abroad to its Covered List, preventing new models from receiving equipment authorization unless they pass a security review or receive Conditional Approval. Conditional Approval requires U.S. manufacturing commitments. Existing authorized routers may remain in use and firmware updates are permitted through at least 2027-03-01. The determination cites supply-chain and critical-infrastructure risks; the article notes that the action does not affect existing devices and that the cited attacks also involved U.S.-designed hardware.
Threat Actors
Flax TyphoonThe determination cited this Chinese state-sponsored cyber campaign. The article says it operated a 260,000-device botnet largely built from compromised consumer routers.Salt TyphoonThe determination cited this Chinese state-sponsored cyber campaign. The article says it penetrated multiple U.S. telecommunications carriers and persisted in their networks for months.Volt TyphoonThe determination cited this Chinese state-sponsored cyber campaign. The article says it pre-positioned inside U.S. critical infrastructure for potential future disruption.
Vendors
AmazonNetgear, Amazon Eero, Google Nest WiFi, Asus, Linksys, and D-Link all manufacture in Asia.AsusNetgear, Amazon Eero, Google Nest WiFi, Asus, Linksys, and D-Link all manufacture in Asia.Ciscohave noted that the Volt Typhoon attacks cited by the FCC as justification, primarily targeted Cisco and Netgear hardware — U.S.-designed products — pointing to software patching failures rather thanD-LinkNetgear, Amazon Eero, Google Nest WiFi, Asus, Linksys, and D-Link all manufacture in Asia.GoogleNetgear, Amazon Eero, Google Nest WiFi, Asus, Linksys, and D-Link all manufacture in Asia.LinksysNetgear, Amazon Eero, Google Nest WiFi, Asus, Linksys, and D-Link all manufacture in Asia.NETGEARNetgear, Amazon Eero, Google Nest WiFi, Asus, Linksys, and D-Link all manufacture in Asia.StarlinkThe one apparent exception is the newer Starlink Wi-Fi router, which the company says is manufactured in Texas.TP-LinkVirtually all routers are made outside the United States, including those produced by U.S.-based companies like TP-Link, which manufactures its products in Vietnam.
Products
Countries
United StatesThe move cites Chinese state-sponsored campaigns that leveraged consumer routers and introduces a Conditional Approval path requiring U.S.VietnamVirtually all routers are made outside the United States, including those produced by U.S.-based companies like TP-Link, which manufactures its products in Vietnam.
Industries
Consumer networkingThe disruption falls entirely on new product cycles — which in a fast-moving consumer networking market means the freeze begins almost immediately.EnergyRouters produced abroad were directly implicated in the Volt, Flax, and Salt Typhoon cyberattacks, which targeted critical American communications, energy, transportation, and water infrastructure.Telecommunicationstelecommunications carriers and persisted inside their networks for months; Volt Typhoon pre-positioned itself inside U.S.TransportationRouters produced abroad were directly implicated in the Volt, Flax, and Salt Typhoon cyberattacks, which targeted critical American communications, energy, transportation, and water infrastructure.Water infrastructureRouters produced abroad were directly implicated in the Volt, Flax, and Salt Typhoon cyberattacks, which targeted critical American communications, energy, transportation, and water infrastructure.