TP-Link Faces Growing Legal Pressure Over Router Security
Router manufacturer TP-Link Systems is facing lawsuits from four more US states over claims relating to cyber security, privacy and the company’s links with China.
Florida, Iowa, Montana and Nebraska filed cases on 6 October, joining Texas, which launched its own action earlier this year.
The lawsuits make a number of allegations, including claims that TP-Link overstated the security of some products and presented its separation from Chinese company TP-Link Technologies in a misleading way.
TP-Link firmly disputes the claims and says it intends to fight them in court.
What Are the States Claiming?
Some complaints point towards security vulnerabilities discovered in TP-Link devices and previously documented cases where cyber criminals or state-linked attackers compromised vulnerable routers.
The states also raise questions about information collected through applications including Tether, Tapo, Deco and Kasa Smart, and the potential implications of Chinese intelligence legislation.
Importantly, the complaints do not establish that TP-Link deliberately created a backdoor for the Chinese government.
TP-Link says it is an independent US company based in California and states that it does not provide customer network information to foreign governments or unauthorised third parties.
Router Vulnerabilities Add to the Debate
The legal action also references vulnerabilities affecting ISP-supplied TP-Link equipment.
Researchers identified multiple security weaknesses which, when combined under certain circumstances, could allow an attacker with access to a device’s management interface to gain extensive control.
Fixes are available, although customers using equipment supplied by an internet provider may depend on that provider to distribute updated firmware.
Separately, 21 US state attorneys general have written to the Federal Communications Commission about TP-Link’s applications for approval of new router models.
For consumers and businesses, the wider lesson applies regardless of manufacturer.
Routers are security devices, not simply boxes that make the Wi-Fi work.
Keep firmware updated, replace unsupported equipment, change default credentials and check that remote administration is disabled unless genuinely required.
The router sitting quietly in the corner deserves rather more attention than the occasional restart when Netflix stops working.