Does TP-Link Have a Backdoor? What the Record Shows and How to Secure Your Router

Hello, this is Ryuta Hamamoto from TIMEWELL.

Search "TP-Link backdoor" and you get a wall of headlines: an FCC ban, a Texas lawsuit, Chinese hackers. If you just flipped your router over and saw a TP-Link logo, you probably want three things answered. Is there actually a backdoor? Where is this company really based? And what should you do with the box sitting on your shelf?

I rewrote this piece to answer those three questions from primary sources. The first version, published in May, contained figures that turned out to be wrong when I checked them again, so I have corrected those too and listed every change in the second-to-last section.

The short answers first.

• Is there a backdoor? As of October 29, 2026, I could not find any public finding by a government agency that TP-Link deliberately planted one. What is on the record is that vulnerabilities in older TP-Link models have been exploited by groups that U.S. and UK agencies and Microsoft link to China and Russia.
• Where is it based? TP-Link Systems Inc. is headquartered in Irvine, California. In Japan, products are sold by TP-Link Japan in Tokyo. The business originated in Shenzhen, China, in 1996. Texas alleges deep ties to China in an ongoing lawsuit, and Nebraska, Iowa, and Florida filed their own suits on October 6. The company says the Chinese government has no access to or control over its design and production.
• What should you do? The same thing you would do with any router. Confirm the model is still supported, update the firmware, change the default password, and turn off remote management.

Does TP-Link have a backdoor?

"Backdoor" gets used for at least three different things. An entry point the manufacturer hid on purpose. A vulnerability caused by sloppy design or code. And malicious firmware that an attacker writes onto a device after breaking in. Headlines blur the three all the time, and a story about a "TP-Link backdoor" often turns out to be about the second or third.

Start with what can be checked. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, keeps a public catalog of vulnerabilities known to be exploited in the wild, the KEV catalog. The October 27, 2026 version has 1,760 entries (1,733 on October 2), and six of them are TP-Link products, the same six as on October 2¹. They are listed as authentication bypass, command injection, missing authentication, and directory traversal flaws. None is listed as a backdoor. Four were added in 2025, and for those four CISA tells agencies to stop using the product if no mitigation is available. Most of the affected models are old and past end of support.

The groups doing the exploiting are on the record too. On October 31, 2024, Microsoft described "CovertNetwork-1658," a network used by multiple Chinese threat actors and made up mostly of TP-Link small office and home office routers. About 8,000 devices were active at any given time, used for password spraying (trying common passwords across many accounts). Microsoft said it was still investigating exactly how the routers were compromised². TP-Link says it released firmware that fixes the vulnerabilities used in that campaign, that the affected models were end-of-life, and that remote administration is not enabled by default³. Then on April 7, 2026, the UK's National Cyber Security Centre reported that APT28, which it attributes to Russian military intelligence, had exploited the TP-Link WR841N and more than 20 other TP-Link models, along with another vendor's routers, to hijack DNS traffic⁴. This is not only a China story.

The first version of this article said Volt Typhoon used TP-Link routers as cover. That was not accurate. When the Justice Department announced on January 31, 2024 that it had disrupted the KV botnet used by Volt Typhoon, it said the vast majority of the routers in that botnet were Cisco and NetGear devices that had reached end of life⁵. What those devices shared was not a brand. It was that nobody was updating them anymore. TP-Link devices do show up a lot in these reports. My reading is that two things drive that: there are a great many of them out there, and older units stay in service long after the patches stop.

If you want to check sourcing concentration as a company: We offer a fill-in version of the 44-item checklist attached to METI's Economic Security Management Guidelines (1st edition). It walks you through items such as dependence on a single supplier and qualifying alternatives in advance. The guidelines themselves state that they are not written with transactions involving any particular country, company, or person in mind, which is one reason I chose them for this article. Download the 44-item self-check worksheet (free; requires your company name and work email)

There are cases of attacker-planted backdoors. In May 2023, Check Point Research reported that a group it tracks as China-linked had flashed malicious firmware onto TP-Link routers. But Check Point was explicit that the implant was written in a firmware-agnostic way and was "not specific to any particular product or vendor"⁶. It also said the attackers most likely got in through known vulnerabilities or weak, guessable passwords. That is not a manufacturer leaving the door open.

There is an older story as well. In 2013, researchers found an unauthenticated debug page in some older TP-Link models, and it got called a backdoor at the time. Hong Kong's computer emergency response team issued a bulletin⁷, and in November 2024 the SANS Internet Storm Center saw attackers probing for that page⁸. Whether it was ever fully patched is unclear, but the devices involved are more than a decade old.

One more mix-up worth clearing. The August 2026 reports of a factory-installed backdoor in more than 20 Chinese router models were about a different manufacturer, disclosed by VulnCheck. They were not TP-Link products⁹. That vendor says the feature was meant for after-sales maintenance, and I covered the question of where maintenance access ends and a backdoor begins in a separate article.

So has any public agency concluded that TP-Link built in a deliberate backdoor? The FCC's March 2026 action covers foreign-produced consumer routers in general and does not name TP-Link¹⁰. The Texas complaint is the state's allegation, not a court finding. I could not find a public government finding of a deliberate backdoor.

Where is TP-Link based, and who controls it?

Start with the company's own account. TP-Link Systems Inc. is headquartered in Irvine, California. In Japan, the seller is TP-Link Japan, established in October 2015 and based in Chiyoda, Tokyo¹¹. In a statement dated December 20, 2024, the company said the Chinese government has no access to or control over the design and production of its routers, that it is no longer affiliated with TP-LINK Technologies, which sells only in mainland China, and that it and its subsidiaries do not sell in mainland China¹². Its security page adds that U.S.-bound networking products have been made in its own factory in Vietnam since 2018 and that core product and data security functions are managed in the United States¹³.

The origins are Chinese. According to the Texas complaint, TP-Link was founded in Shenzhen in 1996 by two brothers¹⁴. A January 2025 ITmedia interview with the Japan unit traced the reorganization: overseas operations began separating in 2022, and in October 2024 they merged with the U.S. entity to become TP-Link Systems¹⁵.

U.S. lawmakers and the State of Texas do not treat that separation as settled. On August 15, 2024, the chair and ranking member of the House Select Committee on the CCP asked the Commerce Department to investigate, citing "TP-Link's unusual degree of vulnerabilities and required compliance with PRC law"¹⁶. On February 17, 2026, the Texas Attorney General sued TP-Link Systems under the state's Deceptive Trade Practices Act¹⁷. The complaint alleges that products labeled "Made in Vietnam" use components sourced overwhelmingly from China, with Vietnamese parts making up less than 1 percent, and claims TP-Link holds 65 percent of the U.S. networking device market¹⁴. In its December 2024 statement, the company said market-share figures cited in the media were not accurate¹². These are allegations, and as of October 29, 2026, I have not seen a court ruling on them.

Other states moved in October. On October 6, the Nebraska Attorney General announced a suit against TP-Link Systems under state consumer-protection law, alleging that statements about its China ties and the security of its routers misled consumers¹⁸. Iowa filed a petition the same day under the Iowa Consumer Fraud Act in Polk County district court¹⁹, and the Florida Attorney General announced a lawsuit dated October 6 as well²⁰. Montana has also been reported to have sued. On October 7, 21 state attorneys general led by Nebraska sent the FCC a letter asking it to address their concerns before deciding on the Conditional Approval TP-Link is seeking for new router models²¹. All of these are positions taken by state officials, not findings by a court or the FCC. As reported on October 7, the company's head of corporate communications called the suits built on false premises, said TP-Link does not and will not share customer network data with foreign governments or unauthorized third parties, and said it looks forward to contesting the claims in court²².

At the root of the concern is China's National Intelligence Law. Article 7 of the 2017 law says organizations and citizens shall support, assist, and cooperate with national intelligence work²³. China's Foreign Ministry responded to this criticism at a February 18, 2019 press conference. The spokesperson said the law also requires intelligence work to respect human rights and the lawful rights of individuals and organizations, and that China has not and will not ask companies or individuals to collect data abroad for the government by installing "backdoors" or by other means that violate local law²⁴. The two positions flatly contradict each other, and outsiders have limited ways to verify either.

So the accurate answer to "what country is TP-Link from" today is roughly this. Incorporated in the U.S., Chinese in origin, manufacturing centered in Vietnam by the company's account, with the sourcing of components contested in court. Honestly, for a home router, I think there is a more useful question. Who builds and signs the firmware, how long will they keep patching it, and how fast? A headquarters address is one clue to that, not the answer.

What the FCC actually banned, and where Japan stands

The U.S. action is often described as an import ban on foreign-made routers. It is narrower than that. On March 20, 2026, an interagency body convened by the White House determined that consumer-grade routers produced in foreign countries pose unacceptable risks to U.S. national security. On March 23, the FCC added them all to its Covered List¹⁰. What that blocks is FCC equipment authorization for new models. Previously authorized models can still be imported, sold, and used. Manufacturers that receive Conditional Approval from the Department of War or the Department of Homeland Security can still get new models authorized.

It is not a TP-Link rule. A router produced abroad is covered even if the brand is headquartered in the United States. The listing is a blanket category based on where routers are produced, not a judgment reached after examining any one manufacturer's products. The FCC cited the involvement of foreign-made routers in the Volt, Flax, and Salt Typhoon campaigns¹⁰. On updates for devices already in homes, the FCC's Office of Engineering and Technology announced on May 8 that software and firmware updates that mitigate harm to consumers, including vulnerability patches, are permitted until at least January 1, 2029²⁵. The logic is that cutting off security patches would hurt the very users the rule is meant to protect. The FCC's Covered List page, which I checked on October 29, lists Conditional Approvals for Netgear (April 14), eero (April 22), ASUS (September 9), Comtrend, and others, but not TP-Link²⁶. TP-Link's application is pending. Light Reading reported that TP-Link made a filing on October 13 pledging nearly $1 billion in U.S. research and manufacturing, with U.S. assembly of its new Wi-Fi 8 routers starting in 2027, and that no FCC response had been reported²⁷. Press reports in September had already described the application as pending²⁸. In October 2025, The Washington Post reported that the Commerce Department had proposed banning sales of TP-Link products with support from several agencies²⁹. I have not found a formal Commerce action published as of October 29, 2026.

Japan has no law that prohibits individuals or companies from buying or using any particular brand of router. Public procurement is a different matter. Under an interministerial agreement of December 10, 2018, national government bodies address supply chain risk when procuring important systems and equipment³⁰. Since May 17, 2024, Japan's Economic Security Promotion Act has also required operators of critical infrastructure such as telecommunications to submit plans for important equipment for government review before installation³¹.

The newest step concerns local governments. On July 31, 2026, Japan's Ministry of Internal Affairs and Communications issued procurement guidance to prefectures and cities³². It tells them, as a rule, to confirm that IoT equipment carries a JC-STAR label (Japan's IoT security conformity label) at level ★1 or above. For unlisted equipment, it asks them to check whether concerns can be ruled out that the legal environment where a developer or maintainer is headquartered could lead to malicious functions being built in³³. No country or company is named. It is not a consumer rule, but the way of thinking carries over well to corporate purchasing. The timeline to the July 1, 2027 start date and the handling of unlisted equipment are covered in Japan's local-government IT procurement rule.

I also need to correct a number about Japan. The first version said TP-Link held 59.9 percent of Japan's Wi-Fi router unit sales. Going back to BCN's data, that figure was TP-Link's 2024 share of Wi-Fi 7 routers only³⁴. Wi-Fi 7 models made up 10.0 percent of all router unit sales in December 2024 and 17.6 percent in May 2025, when TP-Link's share of that segment was 55.1 percent and Buffalo's 19.9 percent³⁵. For wireless LAN as a whole, Buffalo took first place in unit sales for 2025 in the BCN Award 2026, its 24th straight year according to the company³⁶³⁷. TP-Link leads the newest category, but it is not "60 percent of Japanese home routers." I regret that the earlier figure overstated the case.

What to do if you use a TP-Link router

Now the practical part. I am not going to tell you to avoid TP-Link, and I am not going to recommend another brand either. When you line up the cases, what keeps showing up is not the manufacturer's nationality. It is expired support and settings nobody touched. The steps are the same for any router.

Japan's Information-technology Promotion Agency (IPA) issued an alert on October 31, 2025 warning that home routers could be hijacked and used as relay points for attacks on others. It recommends strong, non-default passwords, prompt patching, replacing or retiring devices that are out of support, never exposing the admin interface to the internet, and rebooting regularly to clear malicious processes from memory³⁸. The Tokyo Metropolitan Police Department asks users to check the admin screen for VPN or DDNS settings they did not create, settings that allow management from outside, and unknown VPN accounts, and to factory-reset the router if they find any³⁹. Some attacks leave changes in place that a password change or update alone will not undo. The UK NCSC's advice in the APT28 case runs along the same lines: never expose management interfaces to the internet, and apply security updates promptly⁴.

Step	What to do	Rough time
1	Read the model and hardware version (for example, v2.0) from the label on the device, then check the manufacturer's site for support status and security advisories40	5 min
2	Update the firmware from the admin page or app, and turn on automatic updates if available	10 min
3	Change the admin password from the default, and set Wi-Fi encryption to WPA3 or WPA2	5 min
4	Turn off remote management and disable features or ports you do not use	5 min
5	Look for VPN or DDNS settings and accounts you did not create, and reset and reconfigure if you find any	10 min
6	If the model is end-of-life, plan a replacement and check the support period before you buy	When replacing

If I had to pick one, it would be step 1. TP-Link publishes security advisories you can search by model⁴⁰. Most of the TP-Link entries in CISA's catalog involve models past end of support¹. Support can differ by hardware version under the same model name, so read the label on the device itself.

JC-STAR started operating on March 25, 2025. IPA's list was updated on October 26, 2026 and now has 378 entries, up from 355 on October 1, and no TP-Link product is on it⁴¹. Only some home Wi-Fi routers carry the label so far, so a missing label alone does not make a product unsafe. Levels ★1 and ★2 rest on the manufacturer's self-declaration, and IPA itself says the label marks a minimum baseline and does not guarantee complete safety⁴². For buying, check the label and the support period together.

Companies should go further. List every router, switch, and wireless access point used in offices and by remote staff, with manufacturer, model, hardware version, and end-of-support date. It is entirely possible for a home router someone bought themselves to end up quietly running a branch office or a warehouse. Keep business networks separate from guest and IoT networks too. How hijacked home routers get used as relays, and how much country-level blocking actually helps, is covered in my article on the limits of geo-blocking. This piece covers product and procurement risk. That one covers attack paths and how to stop them.

How much of this your staff already knows depends on how you train them. The AI literacy check gives you a quick read on where your team stands on AI basics, security included.

What changed since the first version (May 2026)

The first version went up on May 12, 2026. Here is what has happened since, and what I corrected after rechecking.

Item	First version (May 12, 2026)	Now (October 29, 2026)
FCC action	"Ban on imports of foreign-made routers"	Blocks authorization of new models. Authorized models can still be imported, sold, and used. TP-Link is not named10
Updates for existing devices	Updates continue through January 2029	Unchanged. Based on the FCC's May 8 notice (until at least January 1, 2029)25
Conditional Approval	Not covered	Netgear, eero, ASUS, and others approved; TP-Link still pending and not on the FCC list (checked October 29)2627
State lawsuits	Texas only	On October 6, Nebraska, Iowa, and Florida sued (Montana reported). On October 7, 21 states wrote to the FCC. All are state positions18192021
State-linked exploitation	Said Volt Typhoon used TP-Link routers as cover	Corrected. The KV botnet was mostly other vendors' end-of-life routers5. TP-Link was central in Microsoft's report2 and in the April 7 UK advisory on APT284
Japan market share	"59.9% of Wi-Fi routers"	Corrected. That was the 2024 Wi-Fi 7 segment only. Buffalo leads wireless LAN overall3436
Japan procurement rules	"Cabinet Office and Digital Agency guidelines since 2020"	Corrected. National bodies follow the 2018 agreement30. Local governments got JC-STAR-based guidance on July 313233
"Backdoor" headlines	Not covered	The August "20 router models" story was a different manufacturer9

I also removed a vulnerability-count comparison attributed to a security researcher, because I could not find the original statement, and replaced a vague reference to a "CVE-2025 authentication bypass" with the six CISA catalog entries.

Looking back, the first version imported the heat of the U.S. debate and leaned toward "Japan is at risk too" without checking the numbers hard enough. Whether the U.S. measure is the right call is still debated. What five months of new information did show is a pattern that has nothing to do with brand: the devices that got exploited were mostly old and unpatched.

The short version

• As of October 29, 2026, I found no public government finding that TP-Link deliberately built a backdoor into its routers. Exploitation of vulnerabilities in older models by state-linked groups is on the record, from U.S. and UK agencies and Microsoft.
• TP-Link Systems is headquartered in Irvine, California. Its roots are in Shenzhen. Texas and several other states disagree with the company about how close its ties to China remain, and no court has ruled.
• The FCC blocked authorization of new foreign-produced consumer routers of every brand. Routers already in use keep working and can receive patches until at least January 1, 2029.
• Japan does not restrict buying or using any brand. Local governments now have procurement guidance built around JC-STAR.
• The fix is the same for any router: confirm support, update, change the default password, turn off remote management, and check for settings you did not make.

Routers are the device people set up once and forget for years, which is exactly why attackers like them. Take five minutes tonight and look at the label on yours. Once you have the model and hardware version, checking whether it is still supported takes no time at all.

For security training and internal rules for staff, see TIMEWELL's WARP program, including WARP SECURITY. If you would like to talk through your own situation, get in touch here.

References

Facts in this article are based on the public sources below, as of October 29, 2026. Items based on press reports are identified as such in the text.

Footnotes

1. Known Exploited Vulnerabilities Catalog — CISA — version of October 27, 2026 (1,760 entries; checked in the JSON feed on October 29) (TP-Link entries: CVE-2015-3035, CVE-2023-1389, CVE-2023-33538, CVE-2020-24363, CVE-2023-50224, CVE-2025-9377) ↩ ↩²

2. Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network — Microsoft Threat Intelligence — October 31, 2024 ↩ ↩²

3. Technical News and Reports about Quad 7 (7777) Botnet aka CovertNetwork-1658 — TP-Link (US) — updated August 29, 2025 ↩

4. APT28 exploit routers to enable DNS hijacking operations — UK National Cyber Security Centre — April 7, 2026 ↩ ↩² ↩³

5. U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure — U.S. Department of Justice — January 31, 2024 ↩ ↩²

6. The Dragon Who Sold His Camaro: Analyzing Custom Router Implant — Check Point Research — May 16, 2023 ↩

7. TP-LINK Router Administrative Web Interface Backdoor Vulnerability — HKCERT — March 15, 2013 ↩

8. Ancient TP-Link Backdoor Discovered by Attackers — SANS Internet Storm Center — November 17, 2024 ↩

9. ENDLESSDOORS (CVE-2026-66747) — VulnCheck — August 5, 2026 ↩ ↩²

10. FACT SHEET: FCC Updates Covered List to Include Foreign-Made Consumer Routers, Prohibiting Approval of New Models — Federal Communications Commission — March 23, 2026 ↩ ↩² ↩³ ↩⁴

11. Company information — TP-Link Japan (Japanese) ↩

12. Statement from U.S. headquarters regarding recent media reports — TP-Link Japan — December 20, 2024 ↩ ↩²

13. TP-Link's approach to security — TP-Link Japan (Japanese) ↩

14. Original Petition, The State of Texas v. TP-Link Systems Inc. — Office of the Texas Attorney General — February 2026 ↩ ↩²

15. Interview with TP-Link Japan on the separation from China-based TP-LINK — ITmedia PC USER (Japanese) — January 27, 2025 ↩

16. Moolenaar, Krishnamoorthi Call for Investigation of Chinese Wi-Fi Routers in the U.S. — House Select Committee on the CCP — August 15, 2024 ↩

17. Attorney General Paxton Sues TP Link for Allowing the CCP to Access Americans' Devices — Office of the Texas Attorney General — February 17, 2026 ↩

18. Attorney General Hilgers Files Suit Against TP-Link as Part of Ongoing Fight to Protect Nebraskans from Exploitation by the Chinese Communist Party — Nebraska Attorney General — October 6, 2026 ↩ ↩²

19. Petition, State of Iowa ex rel. Attorney General Brenna Bird v. TP-Link Systems Inc. (Iowa District Court for Polk County) — Iowa Attorney General — document dated October 6, 2026 ↩ ↩²

20. Attorney General James Uthmeier Files Lawsuit Against TP-Link Systems — Florida Attorney General — release dated October 6, 2026 (the body could not be retrieved; title and date checked) ↩ ↩²

21. Attorney General Hilgers Leads Multi-State Coalition Raising Concerns Over TP-Link's China Ties — Nebraska Attorney General — October 7, 2026 ↩ ↩²

22. US states sue popular kitmaker TP-Link over China risks — The Register — October 7, 2026 (news report; includes a comment from TP-Link Systems' head of corporate communications) ↩

23. National Intelligence Law of the People's Republic of China (adopted June 27, 2017; amended April 27, 2018) — 12371.cn (Chinese) ↩

24. Regular press conference by Foreign Ministry spokesperson Geng Shuang — Ministry of Foreign Affairs of the PRC (Chinese) — February 18, 2019 ↩

25. OET Announces Extension and Expansion of Waiver ... Covered UAS, UAS Critical Components, and Routers (DA 26-454) — FCC Office of Engineering and Technology — May 8, 2026 ↩ ↩²

26. List of Equipment and Services Covered By Section 2 of The Secure Networks Act (Covered List and Conditional Approvals) — FCC — checked October 29, 2026 ↩ ↩²

27. TP-Link pledges $1B US investment amid mounting government resistance — Light Reading — October 15, 2026 (press report) ↩ ↩²

28. Asus routers escape US foreign-made router ban — TechSpot — September 11, 2026 (press report) ↩

29. U.S. agencies back banning TP-Link home routers on security grounds — The Washington Post — October 30, 2025 (press report) ↩

30. Interministerial agreement on procurement policies and procedures for government IT (December 10, 2018; amended July 6, 2021) — reproduced by Japan's Fire and Disaster Management Agency (Japanese) ↩ ↩²

31. Press conference by Minister Takaichi on the start of the critical infrastructure review system — Cabinet Office of Japan (Japanese) — May 17, 2024 ↩

32. Notice on the supply chain risk procurement guidance for local governments — Ministry of Internal Affairs and Communications (Japanese) — July 31, 2026 ↩ ↩²

33. Selection criteria and specification guidance for supply chain risk in local government equipment procurement — Ministry of Internal Affairs and Communications (Japanese) — July 2026 ↩ ↩²

34. TP-Link takes No.1 in Wi-Fi 7 routers — BCN Retail (Japanese) — January 27, 2025 ↩ ↩²

35. Wi-Fi 7 share of wireless LAN router sales hits a record — BCN Retail (Japanese) — June 6, 2025 ↩

36. BCN AWARD 2026 — BCN (Japanese) — January 2026 ↩ ↩²

37. No.1 in wireless LAN unit share for 24 straight years at BCN AWARD 2026 — Buffalo Inc. (Japanese) — January 19, 2026 ↩

38. Alert on home and IoT routers being turned into ORBs (Operational Relay Boxes) — IPA (Japanese) — October 31, 2025 ↩

39. Alert on misuse of home routers — Tokyo Metropolitan Police Department (Japanese) ↩

40. Security advisories — TP-Link Japan (Japanese) ↩ ↩²

41. List of products with conformity labels — IPA (Japanese) — updated October 26, 2026 (378 entries, all valid; checked October 29, 2026) ↩

42. Security Requirements Conformity Assessment and Labeling Scheme (JC-STAR) — IPA (Japanese) ↩