Texas Lawsuit Spotlights TP-Link Router Security Concerns Amid Chinese Supply Chain Risks

The Texas Attorney General's Office has filed a lawsuit against networking equipment manufacturer TP-Link Systems, alleging the company misled consumers about router security while enabling Chinese state-sponsored hacking operations against American users. The case highlights escalating concerns about supply chain vulnerabilities in critical network infrastructure.

Attorney General Ken Paxton's complaint asserts TP-Link falsely marketed routers as "Made in Vietnam" while sourcing nearly all components from China. "Chinese law compels companies with supply-chain ties to cooperate with government intelligence requests," Paxton stated. "TP-Link's deception enables secret surveillance and exploitation of Texas consumers." The lawsuit follows a multi-agency investigation launched in October 2025.

The filing documents a pattern of security failures, including firmware vulnerabilities exploited by Chinese hacking groups. Notably, TP-Link routers formed the backbone of the Quad7 botnet (also tracked as CovertNetwork-1658), which Microsoft linked to Chinese threat actors in 2024. This infrastructure was used for credential theft and password-spray attacks against US targets.

Cybersecurity experts emphasize the national security implications. "When routers get compromised, they become ideal surveillance points," explains network security researcher Amanda Rousseau. "They can intercept traffic, redirect connections, and create persistent access to entire networks. Consumers should treat routers as critical security devices, not just connectivity tools."

Current CISA vulnerability listings include six actively exploited TP-Link flaws. Federal agencies have previously issued warnings about TP-Link vulnerabilities, and in 2024, the US government reportedly considered banning TP-Link routers entirely amid investigations by the Departments of Justice, Commerce, and Defense.

TP-Link disputes the allegations, stating: "Neither the Chinese government nor the CCP exercises control over TP-Link, its products, or user data. All US user data is stored on Amazon Web Services servers." The company emphasizes its American incorporation and California-based CEO.

Practical Security Recommendations

For consumers concerned about router security:

1. Verify firmware updates: Check manufacturer sites monthly for security patches. Enable automatic updates when available
2. Change default credentials: Always replace factory-set usernames/passwords with strong, unique alternatives
3. Segment networks: Place IoT devices on separate network segments from computers and phones
4. Monitor device lists: Regularly check connected devices in your router admin panel
5. Research supply chain: Prioritize companies with transparent manufacturing disclosures

This lawsuit occurs amid increased scrutiny of foreign-made technology. In December 2025, Texas filed similar actions against television manufacturers over unauthorized data collection. Paxton seeks civil penalties and injunctions requiring TP-Link to disclose Chinese component origins and obtain explicit consent for data collection.

The case underscores how geopolitical tensions increasingly impact consumer technology choices. As network devices become surveillance vectors, experts recommend treating router selection as a security decision rather than purely a connectivity purchase.