TP-Link and the FCC router rule: what owners should know
Updated
You can keep using your TP-Link router. The FCC's March 2026 rule stops new consumer router models produced abroad from getting FCC authorization; it does not ban routers already sold, and it does not stop stores from selling models authorized before March 23, 2026 (FCC Fact Sheet). Security updates for those models are allowed at least until January 1, 2029 (DA 26-454).
Why TP-Link is in the news
- No Conditional Approval. More than a dozen router makers have an FCC Conditional Approval that lets some of their new products be authorized. In the FCC notices up to October 2, 2026, TP-Link is not among them. That affects new TP-Link models produced abroad, not the ones people already own.
- State lawsuits. On October 6, 2026, Florida, Iowa, Montana and Nebraska each filed a consumer protection lawsuit against TP-Link. According to the announcements and press coverage, they allege misleading security marketing, undisclosed ties to China and problems with its app's data practices. TP-Link disputes the claims. Texas filed its own lawsuit in February 2026. These are allegations, not court findings.
The security side
CISA's catalog of Known Exploited Vulnerabilities, the flaws attackers are known to have used, listed six TP-Link entries in October 2026. Among them: CVE-2023-1389 in the Archer AX21, added in May 2023, and CVE-2025-9377, added in September 2025, which covers the Archer C7 (EU) and the TL-WR841N/ND (MS). CISA notes that some affected models may be past their end of life. If your model is named in one of them, make sure the latest firmware is installed; if the model no longer gets updates, replace it.
The checker shows the entries that mention your exact model, with links to each record in the US National Vulnerability Database.
If you are thinking of replacing it
- There is no legal deadline: replace a router because it no longer gets security updates, not because of the FCC rule.
- When you compare new routers, check how long the maker promises to ship updates, and whether automatic updates are on by default.
- Whatever you choose, change the default admin password and turn off remote administration unless you need it.
TP-Link is a trademark of its owner. This page is independent and not affiliated with TP-Link, the FCC or any state attorney general. General information, not legal advice.