Should You Replace Your TP-Link Router? We Asked 4 Cybersecurity Experts to Weigh In

It is not each day a humble Wi-Fi router makes an look within the halls of Congress. However that is precisely what occurred on March 5 when Rep. Raja Krishnamoorthi, a Democrat from Illinois, held up a TP-Hyperlink router and mentioned, “Don’t use this.”

Krishnamoorthi has been urging a ban of the routers for months in response to a number of China-backed cyberattacks final yr. Investigators on the Commerce, Protection and Justice departments all opened probes into TP-Hyperlink routers in 2024 attributable to ties to Chinese language cyberattacks.

These departments are weighing a possible ban on the sale of TP-Hyperlink routers, The Wall Avenue Journal reported in December. Together with Rep. John Moolenaar, a Republican from Michigan, Krishnamoorthi spurred the investigation over the summer season with a letter to the Division of Commerce calling for an instantaneous ban.

A possible ban is extra in regards to the firm’s hyperlinks to China than particular safety points which have been publicly recognized, in response to cybersecurity researchers I spoke with. 

TP-Hyperlink was based in 1996 by brothers Zhao Jianjun and Zhao Jiaxing in Shenzhen, China. In October final yr, it moved its headquarters to Irvine, California, two months after the Home introduced an investigation into the corporate. The corporate instructed CNET it had beforehand operated twin headquarters, in Singapore and Irvine.

Within the Home’s Choose Committee on China listening to, Rob Joyce, former director of cybersecurity on the Nationwide Safety Company, additionally instructed the committee that TP-Hyperlink routers are a menace to US cybersecurity.

“We have to all take motion and exchange these units so they do not change into the instruments which might be used within the assaults on the US,” Joyce mentioned.

In a press release to CNET, TP-Hyperlink President Jeff Barney mentioned, “Witnesses on the listening to didn’t current a shred of proof that TP-Hyperlink is linked to the Chinese language authorities and we’re not.”

TP-Hyperlink has change into more and more dominant within the US router market for the reason that pandemic. In accordance with the Journal report, it grew from 20% of whole router gross sales in 2019 to round 65% this yr. TP-Hyperlink disputed these numbers to CNET, and a separate evaluation from the IT platform Lansweeper discovered that 12% of house routers at present used within the US are made by TP-Hyperlink. 

“Individuals anticipate there to be some smoking gun or one thing in these units from Chinese language producers, and what you find yourself discovering is the very same issues in each system. It is not just like the Chinese language units are manifestly insecure,” Thomas Tempo, CEO of cybersecurity agency NetRise and a former safety contractor for the Division of Vitality, instructed CNET. “That is not the danger. The danger is within the company construction of each Chinese language firm.”

Watch this: Finest Wi-Fi Routers for 2025: A Shopping for Information

06:14

In my conversations with TP-Hyperlink representatives, they’ve repeatedly distanced themselves from ties to China. 

“TP-Hyperlink has a safe, vertically built-in and US-owned worldwide provide chain,” a TP-Hyperlink consultant instructed CNET. “Almost all merchandise offered in the USA are manufactured in Vietnam.”

Even so, the US authorities seems to see TP-Hyperlink as a Chinese language entity. In August, the Home Choose Committee urged an investigation into the corporate. 

“TP-Hyperlink’s uncommon diploma of vulnerabilities and required compliance with [Chinese] legislation are in and of themselves disconcerting,” the lawmakers wrote. “When mixed with the [Chinese] authorities’s widespread use of [home office] routers like TP-Hyperlink to perpetrate intensive cyberattacks in the USA, it turns into considerably alarming.”

Requested for remark, a TP-Hyperlink consultant instructed CNET, “Like many shopper electronics manufacturers, TP-Hyperlink Programs’ routers have been recognized as potential targets for hackers. Nonetheless, there is no such thing as a proof to counsel our merchandise are extra susceptible than these of different manufacturers.”

CNET has a number of TP-Hyperlink fashions on our lists of the very best Wi-Fi routers and can monitor this story carefully to see if we have to reevaluate these decisions. Although our analysis of the {hardware} hasn’t modified, we’re pausing TP-Hyperlink routers as our prime advice till we study extra.

A ban is extra about TP-Hyperlink’s ties to China than a identified technical challenge

The cybersecurity consultants I spoke with all agreed that TP-Hyperlink had safety flaws, however so do all router corporations. It’s unclear whether or not the federal government has discovered a brand new challenge that may result in a possible ban on TP-Hyperlink gross sales.

The Wall Avenue Journal article cited federal contracting paperwork that present TP-Hyperlink routers bought by businesses from the Nationwide Aeronautics and Area Administration to the Protection Division and Drug Enforcement Administration.

The potential ban comes at a time in Washington when there may be rising bipartisan assist for extracting Chinese language merchandise from US telecommunications. In an assault revealed in October dubbed Salt Storm, Chinese language hackers reportedly broke into the networks of US web suppliers like AT&T, Verizon and Lumen, which owns CenturyLink and Quantum Fiber.

“Vulnerabilities in embedded units are usually not distinctive to anybody producer or nation of origin,” mentioned Sonu Shankar, chief product officer at Phosphorus Cybersecurity. “Nation-state actors incessantly exploit weaknesses in units from distributors worldwide, together with these offered by American producers.”

Brendan Carr, Trump’s choose for Federal Communications Fee chairman, mentioned in an interview with CNBC {that a} latest intelligence briefing on the Salt Storm assault “made me wish to principally smash my telephone on the finish of it.”

“In some ways, the horse is out of the barn at this level,” Carr mentioned. “And we’d like all arms on deck to attempt to handle this and rein this in.”

TP-Hyperlink hasn’t been linked to the Salt Storm assaults, however it does present the present temperature for perceived threats from China. 

The federal government might have recognized a TP-Hyperlink vulnerability, however we don’t know for certain

A number of of the cybersecurity consultants I spoke with consider it’s doubtless that intelligence businesses have discovered one thing with TP-Hyperlink that warrants a ban. 

“I believe this comes from a deeper intelligence inside the US authorities. Normally this occurs earlier than the knowledge turns into public,” Guido Patanella, senior vice chairman of engineering at Lansweeper, instructed CNET.

“I believe it is past political,” Patanella added. “It might be both an deliberately set {hardware} flaw or it might be from a firmware viewpoint. That is often a black field evaluation and it often would not get shared, as occurred with Huawei.”

In 2019, Trump issued an government order that successfully banned US corporations from utilizing community tools from Huawei, one other Chinese language firm that got here underneath fireplace over nationwide safety issues. 

Tempo, the NetRise CEO, instructed me he thinks it’s doubtless that there’s a “zero-day” vulnerability in TP-Hyperlink units — a time period that refers to a hidden flaw through which there have been zero days to repair it — however he was fast to level out that there’s no proof to again that up. 

“However at the very least that declare is predicated in some kind of actuality that we’re conscious of that exists, which is that the PRC (Individuals’s Republic of China) is concerned in each Chinese language company. And that is plain,” Tempo mentioned.

TP-Hyperlink has identified safety flaws, however so do all router corporations

A TP-Hyperlink consultant pointed us to the Cybersecurity and Infrastructure Safety Company’s checklist of Recognized Exploited Vulnerabilities. TP-Hyperlink has two of those occasions catalogued, in comparison with eight for Netgear and 20 for D-Hyperlink; different in style router manufacturers like Asus, Linksys and Eero have none. 

By this measure, TP-Hyperlink isn’t distinctive in both path, however that may not be all that helpful of a measure.

“We have analyzed an astonishing quantity of TP-Hyperlink firmware. We discover stuff, however we discover stuff in every little thing,” mentioned Thomas Tempo, CEO of cybersecurity agency NetRise and former safety contractor for the Division of Vitality.

“The issue with the CISA KEV [list] is, if every little thing’s on the checklist, how good is that checklist?” Tempo added. “Principally, each telecommunications system on the planet has at the very least one vulnerability on the CISA KEV. It is a massive drawback that there are usually not nice solutions to.”

There have additionally been a number of cybersecurity reviews which have singled out TP-Hyperlink particularly. Probably the most high-profile one got here in October when Microsoft launched particulars on a password spraying assault it had been monitoring for over a yr. In any such assault, hackers use a single widespread password to entry a number of accounts. 

Microsoft referred to the assault as “nation-state menace actor exercise” and mentioned TP-Hyperlink made up a lot of the routers used.

In Could 2023, Test Level Analysis additionally recognized a firmware implant in TP-Hyperlink routers linked to a Chinese language state-sponsored hacking group. On this case, the marketing campaign focused European overseas affairs entities. Nonetheless, the researchers emphasised that the assault was written in a “firmware-agnostic method” and wasn’t designed to take advantage of TP-Hyperlink particularly. 

“Whereas our evaluation targeted on its presence in modified TP-Hyperlink firmware, earlier incidents present that comparable implants and backdoors have been used on units from numerous producers, together with US primarily based,” Itay Cohen, one of many authors of the Test Level Analysis report, instructed CNET.   

“The broader implication is that this implant isn’t about focusing on a selected model — it’s half of a bigger technique to take advantage of systemic vulnerabilities in web infrastructure.”

Cohen mentioned he doesn’t consider a TP-Hyperlink ban would enhance safety a lot. As I heard from different researchers, the safety points which have been recognized are usually not distinctive to at least one firm. 

“The vulnerabilities and dangers related to routers are largely systemic and apply to a variety of manufacturers, together with these manufactured within the US,” Cohen mentioned. “We don’t consider that the implant we discovered was identified to TP-Hyperlink or was knowingly inserted as a backdoor to their merchandise.”

Is it protected to make use of a TP-Hyperlink router?

There are actual dangers related to utilizing a TP-Hyperlink router, however some stage of danger is current it doesn’t matter what model of router you utilize. Basically, cyberattacks tied to Chinese language actors have focused assume tanks, authorities organizations, nongovernment organizations and Protection Division suppliers, in response to the Journal’s reporting. 

“I do not assume that the typical individual goes to have this huge goal on their again,” Tempo instructed CNET. “They have a tendency to go after the issues they wish to go after.”

That mentioned, these sorts of assaults are sometimes indiscriminate, with the objective of making a series of nodes between contaminated routers and hackers. 

“This implies common customers are prone to being focused as a part of a broader assault marketing campaign, even when they aren’t individually focused,” mentioned Cohen, the Test Level Safety researcher. 

The way to shield your self when you have a TP-Hyperlink router

To maintain your community protected and safe, it is best to comply with the identical steps whether or not you could have a TP-Hyperlink router or some other model. Right here’s what consultants advocate:

• Preserve your firmware up to date: One of the vital widespread methods hackers entry your community is thru outdated firmware. TP-Hyperlink instructed us that clients with TP-Hyperlink Cloud accounts can merely click on the “Test for Updates” button of their product’s firmware menu when logged into the TP-Hyperlink app or web site. You can too discover the newest updates in TP-Hyperlink’s obtain heart. 
• Strengthen your credentials: For those who’ve by no means modified the default login credentials in your router, now’s the time to do it. Weak passwords are the reason for many widespread assaults. “Gadgets utilizing default or weak passwords are simple targets,” Cohen instructed CNET. “Default or easy passwords could be simply brute-forced or guessed.” Most routers have an app that permits you to replace your login credentials from there, however you may also kind your router’s IP handle right into a URL. These credentials are completely different out of your Wi-Fi identify and password, which must also be modified each six months or so. The longer and extra random the password, the higher. 
• Think about using a VPN service: For an added layer of safety, a digital non-public community will encrypt all your web site visitors and stop your web supplier (or anybody else) from monitoring the web sites or apps you’re utilizing. You will discover CNET’s picks for the very best VPN companies right here. 
• You have got router decisions: In CNET’s testing, TP-Hyperlink routers have constantly ranked as a number of the top-performing routers to select from. If you’re out there for a brand new router however feeling additional cautious, CNET names a couple of different nice choices to select from right here.