Florida and Three States Sue TP-Link Over Router Security Claims: Check Firmware Support

What Florida alleges​

Attorney General James Uthmeier has filed a civil lawsuit against the Wi-Fi router maker. It alleges the company misled Florida consumers about its products' security and its ties to China. The 59-page complaint was filed in Polk County, in Florida's 10th Judicial Circuit.

In a recorded video, Uthmeier said TP-Link falsely claimed that its routers and its HomeShield security service covered every security scenario and offered 100% protection. He made three further claims:

• Chinese state-sponsored hackers exploited TP-Link routers, and many of those models cannot update themselves automatically. He also said TP-Link has stopped supporting them.
• TP-Link told Floridians it had split from China and builds U.S. products in Vietnam. He called that "fiction," and said research and manufacturing remain rooted in China.
• He also said less than 1% of the parts in the Vietnam plant come from Vietnam.

Uthmeier is asking for relief. He said, "We are seeking an injunction, restitution for Florida consumers and the penalties under Florida law."

I could not read the Florida complaint itself. The specific counts and the product examples cited in it are therefore unverified here. The details above come from the attorney general's public statements as reported by Florida Politics and Tom's Hardware.

A coordinated, four-state action​

Florida is not alone. Law360 reports that the attorneys general of Florida, Montana, Nebraska and Iowa sued California-based TP-Link Systems Inc. on Tuesday. Their allegation is that it concealed links to a Chinese company and deceptively promoted its products as secure despite vulnerabilities.

The other states have published their own allegations:

• Nebraska's attorney general says TP-Link controls at least 60 percent of the U.S. retail market for Wi-Fi systems and small-office/home-office routers. Nebraska is seeking civil penalties and fees under its Consumer Act and Uniform Deceptive Trade Practices Act, among other relief.
• Iowa's attorney general makes a similar case. She says TP-Link's routers are made in Vietnam with nearly all parts imported from or through China. She also alleges the firmware gives the Chinese government access to devices and data.

Each state pleaded under its own laws. Don't assume Florida's claims match Nebraska's or Iowa's word for word.

TP-Link's response​

TP-Link responded the same day. Its statement says the coordinated lawsuits are "built on false premises." The company says it has given regulators documentation showing two things:

• Its U.S.-sold devices are manufactured in Vietnam.
• It is an independent U.S. company that is not owned or controlled by any foreign government.

The company also says it does comprehensive security testing and uses third-party security labs. It says it does not and will not share customer network data with foreign governments or unauthorized third parties. Treat these as the company's position. They are not independent findings.

How this got here​

Florida's suit follows an earlier investigation. On December 2, 2025, Uthmeier announced a subpoena to TP-Link Systems Inc. It looked at the company's cybersecurity practices, handling of U.S. consumer data and supply-chain infrastructure. The subpoena demanded documents on corporate structure, software development, manufacturing, data handling and evidence backing the company's security claims. The state's own release noted that a subpoena is not a determination of wrongdoing.

The subpoena also shows what the state was testing. It quoted company statements about no longer being affiliated with the China-based TP-Link Technologies. It also quoted statements about an internal penetration-testing team. Those are the kinds of marketing claims a deceptive-practices case turns on.

The Florida statute named in the state's earlier announcement is the Florida Deceptive and Unfair Trade Practices Act. It sits in Chapter 501, Part II of the Florida Statutes, and includes sections on remedies and civil penalties. I have not confirmed which sections the complaint relies on.

The federal angle: don't conflate it​

Tom's Hardware says the FCC has restricted new consumer router imports. It also says TP-Link applied for conditional approval and that it is unclear whether it has received one. That federal action reaches well beyond TP-Link. It is not a TP-Link-only ban.

TP-Link's own April 2026 statement says that action does not affect routers already sold. It says existing routers "remain fully authorized, supported" and will keep getting regular firmware and security updates. That is the company's assurance. Florida's allegation is that some models are not supported, and the two claims can both be true. TP-Link may support many current models while some older ones sit past end of life.

Tom's Hardware also says federal agencies opened inquiries in 2024. I could not independently confirm that timeline, so treat it as the outlet's account.

What this means if you own a TP-Link router​

The legal fight will take months or longer. Router hygiene does not need to wait. The security lesson applies to any brand.

1. Find your exact model and hardware revision. This is usually on the label on the bottom of the router. Revisions of the same model can have very different support status.
2. Check the vendor's support page for that revision. Look for a current firmware release and any end-of-life or end-of-support notice.
3. Install the latest firmware. If the router can't update itself automatically, set a recurring reminder to check manually.
4. Turn off remote management unless you really need it. Exposed admin interfaces are a common way routers get compromised.
5. Replace routers that no longer receive security updates. This applies whoever made them. An unsupported router is a risk regardless of the lawsuit.
6. Change default admin credentials and use a strong, unique Wi-Fi password.

Where the Florida AG says "many of those models" can't update automatically, I could not verify which models he means. Don't assume every TP-Link router is affected. Equally, don't assume yours is fine because the company says so.

Analysis: why this matters beyond the headline​

Several things stand out:

• It's consumer-protection law, not a security ruling. The core claims are about what the company told buyers. A court can find marketing misleading without finding any particular router unsafe, and the reverse is also possible.
• Separation claims will be tested on facts. Both sides cite the same 2024 corporate separation. Whether it amounts to real independence will depend on evidence about R&D, firmware development and parts sourcing, which the complaints and any court record will have to supply.
• "100% protection" language is risky for any vendor. No security product can honestly promise that. Marketing claims like this are easy targets for regulators.
• There's a distinction to keep in mind. Allegations about the Chinese-military-linked entity TP-Link Technologies do not, on their own, establish that the U.S. defendant is owned or controlled by China. That is one of the questions the case will have to resolve.

Bottom line​

Four states have sued TP-Link Systems Inc. over its security and China-ties claims. Florida filed in Polk County and wants an injunction, restitution and penalties. TP-Link denies everything and says it will fight in court. Whatever happens, check your router's model, revision, firmware and support status today. Replace anything that no longer gets security updates.