Texas Sues TP-Link for Covering Up Chinese Manufacturing

The Texas attorney general invoked state consumer protection law to sue Wi-Fi router maker TP-Link Systems for misrepresenting its connections to mainland China and the security of its ubiquitous devices.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The suit, filed Monday in a county courthouse on the outer edges of Dallas, alleges that TP-Link falsely asserts its routers are made in Vietnam. State Attorney General Ken Paxton accused the company of maintaining at least four major facilities in China and of using Vietnamese facilities merely as final assembly points for Chinese-made components.

“Despite its claims of privacy and security, TP-Link’s products have been used by People’s Republic of China’s state-sponsored hacking entities to launch multiple cyberattack operations against the United States,” the attorney general’s officer said.

The lawsuit is one of a handful Paxton has made against Chinese companies, including a December suit against television makers Hisense and TCL and a lawsuit filed Wednesday against Anzu Robotics.

The attorney general is vying for the Texan Republican U.S. Senate nomination in the March 3 primary election as a “Make America Great Again” acolyte.

The suit says the company should pay up to $10,000 for each violation of the Texas Deceptive Trade Practices Act and be forced to declare that their products are made in China. Citing security flaws including CVE-2025-9377, a remote command execution vulnerability in end-of-life TP-Link routers uncovered in August, the suit also demands that the company stop marketing its produces as “secure.”

It additionally asks for a temporary restraining order stopping it from collecting or disclosing the data of Texan consumers, something the suit alleges the company does through mobile applications.

The suit says Paxton has jurisdiction through the sale of TP-Link routers in two Best Buy locations and one Walmart Supercenter in separate Dallas–Fort Worth commuter suburbs.

The lawsuit targets TP-Link Systems, a corporate entity based in Irvine, California, which the company says is distinct from China-based TP-Link Technologies. According to the company, the two firms finalized a split in October 2024, with the private California company taking over global sales. Bloomberg reported last April that TP-Link Systems continues to employ 11,000 people in China, including at Shenzhen Lianzhou International Technology, a manufacturing and research and development arm that has Chinese government investment.

Trump administration officials backed a proposal to ban TP-Link sales on national security grounds, The Washington Post reported in October. That’s been put on hold as Washington prepares for an April meeting between U.S. President Donald Trump and Chinese leader Xi Jinping, Reuters reported Thursday.

Chinese-made networking gear has come under a mounting number of restrictions in the United States, including bans on telecom equipment made by Huawei and ZTE and video surveillance equipment makers Hikvision and Zhejiang Dahua Technology. Beijing critics say the gear comes freighted with too much potential risk of state-driven exploitation to be safely used.

“The reality is that TP-Link continues to operate its supply-chain deep inside of China, with China’s support and through Chinese exports,” the Texas lawsuit states. How large a market share the company has in the United States is difficult to pinpoint with certainty. One commonly cited figure is roughly 65%, although the company says it has a 37% share of the U.S. consumer router market.

Chinese nation-state hackers have exploited TP-Link routers in campaigns by threat actors tracked as Volt, Flax and Salt Typhoon, former NSA Cybersecurity Director Rob Joyce told a congressional select committee in March 2025. TP-Link routers are mostly prevalent in the consumer and small business market rather than enterprises, where routing equipment made by Silicon Valley mainstay Cisco plays a major role (see: Talos: No Cisco Zero Days Used in Salt Typhoon Telecom Hacks).

For its part, TP-Link says it’s the victim of slander and sued rival Netgear in November for giving “false and misleading information to third parties such as media personnel, operatives, consultants and other businesses to act as mouthpieces for Netgear’s smear campaign.”