Four States Sue TP-Link Over Router Security Claims as ISP Flaws Draw Scrutiny
Summary
Four states sued TP-Link over alleged misleading security claims and China ties. The complaints cite five ISP-router vulnerabilities affecting 65 devices; fixes are distributed through ISPs, and some devices may remain unpatched.
Key points
- Florida, Iowa, Montana, and Nebraska filed consumer-protection lawsuits against TP-Link on October 6; Texas filed a similar suit in February.
- The complaints cite TP-Link marketing that described HomeShield as covering “all security scenarios” and offering a “100% safeguard,” alongside reports of routers exploited in threat campaigns.
- SEC Consult detailed five flaws, CVE-2025-30237 through CVE-2025-30241, affecting TP-Link Aginet ISP-managed systems, routers, and modems.
- The flaws include an authentication bypass, privilege escalation, command injection, hardcoded encryption keys that can expose credentials, and a physical-access USB issue.
- TP-Link identified 65 affected devices, including ISP-customized variants. Firmware fixes rolled out into 2026 and are distributed by ISPs; users should check for updates or contact their ISP.
- SEC Consult withheld proof-of-concept code because many vulnerable devices may remain unpatched.
Article Details
- Event Type
- Four US states sued TP-Link Systems over alleged misleading security and China-related claims; researchers also disclosed five vulnerabilities affecting TP-Link Aginet devices.
- Impact
- The states seek injunctions, civil penalties, and the return of money allegedly obtained through violations. The vulnerabilities could allow device compromise, unauthorized administrator actions, command execution with root privileges, recovery of passwords and other credentials, or access to the device file system. TP-Link identified 65 affected devices, and the rollout of fixes extended into 2026.
MITRE ATT&CK
CVE
CVE-2025-30237To show that TP-Link’s security problems persist, the complaints cite five vulnerabilities, tracked as CVE-2025-30237 through CVE-2025-30241, that TP-Link disclosed in August.CVE-2025-30238CVE-2025-30238 allows a low-privileged user to perform actions meant for administrators.CVE-2025-30239CVE-2025-30239 stems from the use of hardcoded encryption keys, tied only to the device model, to protect configuration files and backups.CVE-2025-30240The fifth issue, CVE-2025-30240, requires physical access.CVE-2025-30241To show that TP-Link’s security problems persist, the complaints cite five vulnerabilities, tracked as CVE-2025-30237 through CVE-2025-30241, that TP-Link disclosed in August.
People
Threat Actors
Vendors
Products
Countries
ChinaFour US states have sued TP-Link Systems, accusing the router maker of misleading consumers about the security of its products and its ties to China.United StatesVietnamresearch, development, and manufacturing remains there, and that only 0.5% of the components used at its Vietnam factory, by value, are bought in Vietnam.