In brief: TP-Link routers, one of the most popular brands of routers in the US and the dominant name in Amazon's best-sellers chart, could be banned in the US. Authorities say the Chinese-made devices, which have been found to contain vulnerabilities in the past, pose a national security risk.
According to a report by the Wall Street Journal citing people familiar with the matter, investigators at the Commerce, Defense and Justice departments have opened their own probes into TP-Link, and authorities could ban the sale of its routers in the US next year. The sources say an office of the Commerce Department has subpoenaed TP-Link.
TP-Link has around 65% of the US market for routers used in homes and small businesses. It gained another 5% share of the market in just the third quarter of this year, the WSJ said. Eleven of the top twenty best-selling routers on Amazon are from the Shenzhen-headquartered company, including the number one (AX3000) and number two (AX1800).
In October, Microsoft exposed a complex network of compromised devices that Chinese hackers are using to launch highly evasive password spray attacks against Microsoft Azure customers, including think tanks, government and nongovernment organizations, and Defense Department suppliers.
This network, dubbed CovertNetwork-1658, has been actively stealing credentials from customers since August 2023. The attacks use a botnet of thousands of small office and home office (SOHO) routers, cameras, and other Internet-connected devices. At its peak, there were more than 16,000 devices in the botnet, most of which were TP-Link routers.
There have been numerous instances where vulnerabilities were discovered in TP-Link routers. In May, a critical vulnerability with a CVSS score of 10.0 was found in the Archer C5400X tri-band router for gaming. By exploiting it, an unauthenticated attacker could inject malicious commands and gain full remote code execution privileges on the vulnerable device.
In 2023, it was reported that Chinese state hackers were infecting TP-Link routers with custom, malicious firmware. This news arrived just months after the US government said Mirai Botnet operators were using TP-Link routers for DDoS attacks.
TP-Link sells its products in the US through a business unit based in California. Asked about potential actions against the company, a spokesperson for the Chinese embassy in Washington said the US was using the guise of national security to "suppress Chinese companies." He added that Beijing would "resolutely defend" the lawful rights and interests of Chinese firms.
Whether a ban on TP-Link routers does happen will ultimately be decided by the Trump administration, which has taken a hardline approach to China. Trump showed with Huawei during his first stint as President that he isn't afraid to go after big Chinese companies. What such a move would mean for millions of TP-Link customers is unclear.