CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

FCC Covered List expansion bans foreign-made consumer routers in U.S. market

First reported
Last updated
4 unique sources, 4 articles

Summary

Hide ▲

The U.S. Federal Communications Commission (FCC) has expanded its Covered List to prohibit the sale of new consumer-grade routers manufactured outside the United States, citing unacceptable national security risks. The ban targets 'consumer-grade' routers as defined in NIST Internal Report 8425A, while permitting continued operation of existing routers and maintaining imports for previously authorized foreign-manufactured models. The decision follows a March 20 National Security Determination identifying severe supply-chain vulnerabilities in foreign-made routers. Exemptions are strictly limited to Department of Defense or Department of Homeland Security drone and surveillance systems, with no blanket exclusions for foreign-made consumer routers. Existing hardware and U.S.-manufactured devices like Starlink routers remain unaffected. Critics warn the policy may leave consumers and businesses reliant on older, less secure routers as replacement markets shrink and compliance costs rise, potentially increasing long-term exposure to operational vulnerabilities rather than reducing them.

Timeline

  1. 24.03.2026 22:41 4 articles · 2d ago

    FCC prohibits new foreign-made consumer routers from U.S. market following national security assessment

    The FCC updated its Covered List to include all consumer routers manufactured abroad, barring their sale as new products in the U.S. The move follows a March 20 National Security Determination identifying supply-chain risks from foreign-made routers that could disrupt critical infrastructure. New certification rules require manufacturers to disclose full supply-chain details and commit to onshoring critical component production. Approval pathways are limited to specific government drone systems, while existing consumer routers remain unaffected. This article adds expert analysis warning that the policy does not force immediate replacement of existing foreign-made routers, leaving consumers and businesses to retain and use currently deployed devices indefinitely unless they choose to upgrade. Critics argue this may increase long-term cybersecurity risk by forcing reliance on outdated, unsupported foreign-made routers as replacement options become constrained or more expensive due to reduced competition and compliance costs. Security experts highlight that router compromises often stem from operational issues such as default credentials, unpatched vulnerabilities, and exposed management interfaces—not solely from manufacturing origin. Only one U.S.-manufactured router model, Starlink Wi-Fi routers, was identified as compliant with the new FCC restrictions.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

U.S. Proposed Ban on TP-Link Networking Gear

The U.S. government is considering a ban on the sale of TP-Link networking devices due to national security concerns over the company's ties to China. TP-Link denies these allegations, maintaining it operates independently and manufactures its products in Vietnam. Texas has sued TP-Link for deceptive marketing and allowing Chinese state-backed hackers to exploit firmware vulnerabilities. The ban is supported by multiple federal agencies and follows reports of Chinese state-sponsored hacking groups exploiting vulnerabilities in TP-Link routers. The proposed ban highlights broader issues with the security of consumer-grade routers, which often ship with outdated firmware and default settings that can be easily compromised.

Open in new tab

TP-Link Router Vulnerabilities Actively Exploited in the Wild

Two security flaws in TP-Link routers are being actively exploited. The vulnerabilities affect multiple router models, including the TL-WR841N and Archer C7. The flaws allow for authentication bypass and remote code execution, respectively. Affected models have reached end-of-life status, and users are advised to upgrade to newer hardware. The exploits are linked to the Quad7 botnet and a China-linked threat actor, Storm-0940. Federal agencies must apply mitigations by September 24, 2025. The vulnerabilities are CVE-2023-50224 and CVE-2025-9377. TP-Link has released firmware updates to address these issues. The affected routers have reached end-of-service status, and users are advised to upgrade to newer hardware for enhanced protection.

Open in new tab