The FCC and four US states target TP-Link while five Aginet flaws remain unpatched

October 6, 2026. Florida, Iowa, Montana and Nebraska sue TP-Link for deceptive trade practices over the security of its routers. October 8, 2026. SEC Consult publishes technical details of five flaws in the Aginet line, from CVE-2025-30237 to CVE-2025-30241. March 2026. The FCC bans the sale of new consumer routers made outside the US, and TP-Link still has no exemption. Why it matters: the legal pressure and the technical reality converge on the same conclusion — for a significant slice of the TP-Link install base, the patch channel is either absent or held by your internet provider.

A double bind: legal and technical

TP-Link is under two parallel pressures that, taken together, change the calculus for anyone running its routers or access points.

The first is regulatory. On October 6, 2026, four Republican state attorneys general filed near-identical complaints under their states’ consumer-protection laws. Their core grievance: TP-Link marketed its products as safe — its HomeShield service “covers all security scenarios” and, as recently as November 2025, promised a “100% safeguard” — while TP-Link routers were exploited in the Volt Typhoon and Flax Typhoon campaigns, in password-spraying botnets, and by Russia’s GRU military intelligence.

The Florida complaint adds a substantive charge: the company’s claimed separation from China is “fiction.” It leans on an April 2025 Bloomberg report that only 0.5% of the value of components at TP-Link’s Vietnam plant is sourced in Vietnam — everything else is imported from China. TP-Link rejects the allegations and calls the lawsuits “built on false premises.”

The second pressure is technical, and it is the one that deserves your attention. On October 8, 2026, SEC Consult published details of five vulnerabilities in the Aginet line — the devices TP-Link sells to internet service providers to equip their subscribers: routers, mesh systems, modems and fiber gear.

Five flaws, one unauthenticated path

The five flaws, CVE-2025-30237 through CVE-2025-30241, affect 65 models in the Aginet line. The most severe is enough on its own:

• CVE-2025-30237 — an authentication bypass in the web interface. An attacker on the same network can, with no credentials at all, create a super-administrator account and enable SSH access.
• CVE-2025-30238 — a low-privileged user can trigger actions reserved for administrators.
• CVE-2025-30239 — hardcoded encryption keys, tied to the device model, protect configuration files. Anyone who obtains a backup can extract Wi-Fi passwords and, depending on configuration, the operator’s remote-management credentials.
• CVE-2025-30240 — physical access: a prepared USB drive can read the entire filesystem.
• CVE-2025-30241 — a command injection in the web interface, allowing root command execution.

The remediation timeline is the real warning signal. SEC Consult first reported these flaws to TP-Link in December 2024. The vendor claimed in January 2025 that the initial issues were fixed, but exhaustively identifying every affected model took until July 2025, and the rollout of fixes — including custom firmware for affected ISPs — stretched into 2026.

A patch channel you don’t control

On the Aginet line, the fix does not flow through the end user: TP-Link says firmware updates are distributed by the ISPs. In other words, the subscriber cannot apply the patch themselves — they depend on the will and the timetable of their provider. If the operator doesn’t push the update, the box stays vulnerable, and the subscriber has no direct lever.

The state complaints hammer a related point: several exploited models do not support automatic updates and no longer receive security updates. That is the most dangerous combination there is — an exposed device, publicly documented as vulnerable, whose lifecycle has ended without its owner being clearly told.

This reaches beyond Aginet. TP-Link’s Omada line already produced a major alert this summer — 15 zero-touch-provisioning flaws presented at Black Hat, which we documented in our analysis of the Omada ZTP flaws. The recurrence draws a pattern: a vendor with an enormous catalog, part of whose install base depends on update channels that the person running it does not control.

An American story with a universal lesson

The FCC ban and the lawsuits are a US story — but the lessons travel. First, because TP-Link equips homes and SMBs across Europe and France too. Second, because the underlying question is universal: who controls the updates to your network gear?

The ban, decided in March 2026, targets consumer routers made wholly or partly outside the US. Exemptions went to Netgear, Asus, Adtran, Amazon and its Eero subsidiary, Calix, Nokia and Starlink. TP-Link is still waiting. The practical consequence: the vendor cannot sell its new Wi-Fi 8 routers in the US, even as it promotes its “next-gen Wi-Fi 8 portfolio.”

TP-Link says it is investing “hundreds of millions of dollars” to move manufacturing and R&D to the US, and already employs more than 550 people there. The exemption process requires a determination from the Pentagon or DHS that the equipment poses no national-security risk. Nothing suggests that determination will arrive soon.

The ripple effects already reach beyond TP-Link. The cable lobby group NCTA has petitioned the FCC for a waiver letting ISPs swap in different components, arguing it is needed “to prevent disruptions in the availability of broadband” amid supply-chain shortages. In other words, a ban aimed at one vendor is already reshaping how the whole consumer-router market — providers included — plans its hardware. The lesson for anyone outside the US is the same one the ban exposes at home: router supply chains and security updates are political terrain as much as technical territory.

What to do with your TP-Link fleet

The answer is not “rip out all TP-Link hardware.” It breaks down into three moves, in priority order:

• Inventory your models. Cross-check what you run against the 65 models in the TP-Link advisory. The Aginet routers, mesh systems, modems and fiber devices are the first concern.
• Identify the patch channel. If the firmware is pushed by your ISP, the update is out of your hands: check the installed version and push your provider if it isn’t fixed. If the device is end-of-life, no fix is coming — plan its replacement.
• Segment in the meantime. A vulnerable device isolated behind a dedicated VLAN, with no access to the management network, is a contained risk. A vulnerable device exposed at the edge is an open door.

If you manage the device yourself, the check is a couple of commands:

# Check the firmware version from a TP-Link device's interface
curl -s http://ROUTER_IP/ --max-time 5 | grep -iE "firmware|version" | head -5

Don’t file this away as an American quarrel. It exposes a structural flaw you probably already have in your own network: network gear whose patch lifecycle escapes you, whether it’s an ISP box, a mesh kit bought online, or a router forgotten in a comms cupboard.

Verdict

If you run a TP-Link Omada fleet, confirm today that the August Black Hat fixes are applied — that is a prerequisite, not an option. If you hold Aginet devices, don’t count on the vendor: the update flows through your ISP, so check the installed version and, where no fix exists, segment or replace. If you have end-of-life TP-Link hardware, no patch will save it — take it off the network or replace it. The lesson that remains when the legal noise dies down is simple: network equipment whose update chain you don’t control is not an asset, it’s a security debt with an unknown due date.

References

• Ars Technica — TP-Link problems in US grow amid FCC router ban and four state lawsuits
• SecurityWeek — TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws
• SEC Consult — Multiple critical vulnerabilities in multiple TP-Link device series (SA-20261008-0)
• TP-Link — Security Advisory: Multiple Vulnerabilities in ISP-Managed TP-Link Networking Products
• NVD — CVE-2025-30237