Policy · 19h ago

TP-Link router flaws move into court and FCC fights

Four more U.S. states sued TP-Link on Oct. 6, bringing the total to five, while 21 state attorneys general separately pressed the FCC over the company’s U.S. approval bid. The complaints say TP-Link overstated both router security and its separation from China; TP-Link says it will fight the claims.

The filings point to public firmware flaws, including CVE-2023-50224 and CVE-2025-30237, and to end-of-life models as evidence that the company’s security marketing did not match the product reality. That matters because the bugs are no longer just patch notes for owners; they are now being used as proof in consumer-protection and regulatory arguments about what buyers were told.

For ISPs, resellers, and procurement teams, the exposure now includes approval fights and advertising claims, not only the routers behind the customer edge. If a vendor’s security story depends on firmware that is publicly documented as flawed, the legal and supply-chain fallout can outlast any fix.

CVE-2023-50224

NVD KEV

Known exploited · CISA KEV

CVSS 6.5 MEDIUM: tP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. EPSS 16% (97th percentile).

CISA federal remediation date Sep 24 · date passed

CVE-2025-30237

NVD KEV

EPSS 0.3% (23rd percentile).

Timeline

Oct 9 Reported by The Hacker News
Oct 8 Reported by SecurityWeek
Oct 7 Reported by The Register Security
Sep 24 CISA federal deadline for CVE-2023-50224 passed
Sep 3 CVE-2023-50224 added to CISA KEV

Sources

3 sources covering this story

The Hacker News Oct 9
TP-Link Sued by Four More U.S. States Over Router Security and China Ties
states sued TP-Link over allegedly misleading claims about router security and China ties, as 21 attorneys general contacted the FCC.
SecurityWeek Oct 8
TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws
SEC Consult has published technical details on vulnerabilities mentioned in a complaint filed by several US states.
The Register Security Oct 7
US states sue popular kitmaker TP-Link over China risks
Router maker rejects allegations it misled buyers about protection and its reliance on Chinese suppliers

Entities

CVE-2023-50224
CVE-2025-30237

Part of the PlainSec briefing for 2026-10-10

Editions

Briefing for 2026-10-10

Policy · 19h agoTP-Link router flaws move into court and FCC fightsFour more U.S. states sued TP-Link on Oct. 6, bringing the total to five, while 21 state attorneys general separately pressed the FCC over the company’s U.S. approval bid. The complaints say TP-Link overstated both router security and its separation from China; TP-Link says it will fight the claims.The filings point to public firmware flaws, including CVE-2023-50224 and CVE-2025-30237, and to end-of-life models as evidence that the company’s security marketing did not match the product reality. That matters because the bugs are no longer just patch notes for owners; they are now being used as proof in consumer-protection and regulatory arguments about what buyers were told.For ISPs, resellers, and procurement teams, the exposure now includes approval fights and advertising claims, not only the routers behind the customer edge. If a vendor’s security story depends on firmware that is publicly documented as flawed, the legal and supply-chain fallout can outlast any fix.