Dive Brief:
- The Federal Communications Commission on Monday said it will no longer approve imported routers for consumer use without government review.
- An interagency body convened by the White House determined that consumer-grade routers made outside the U.S. present an unacceptable risk to national security, according to FCC officials.
- The Trump administration’s 2025 National Security Strategy says the U.S. should not be dependent on an outside power for core components considered vital to the nation’s economy or defense.
Dive Insight:
The determination follows rising concerns in recent years that foreign adversaries, particularly China, were exploiting critical vulnerabilities and poor security configurations to launch espionage and other malicious attacks.
“I think it’s clear that consumer routers produced by foreign adversaries or foreign countries of concern do pose severe national security risks,” Jack Burnham, analyst for the China Program at the Foundation for Defense of Democracies, told Cybersecurity Dive.
However, Burnham cautioned that it has yet to be determined whether such a maximalist prohibition of new consumer-grade routers will fully solve the security problem.
Router manufacturers will be able to apply for conditional approval from the Defense and Homeland Security departments, according to the FCC. Many of the routers developed by Chinese manufacturers are not actually produced on the Chinese mainland and are sold through joint ventures and partnerships with companies in other parts of the world, Burnham noted.
The recent focus on routers has been linked to the rise of state-linked threat groups, including Volt Typhoon, Flax Typhoon and Salt Typhoon. Much of the malicious activity linked to these adversaries has included exploitation of critical flaws in consumer routers.
Millions of Americans work from remote homes or small businesses and are regularly accessing IT networks at major U.S. companies and government agencies.
Beginning in 2023, Microsoft researchers found that Volt Typhoon leveraged small office/home office routers and other edge devices to gain access to larger enterprise networks.
Lawmakers in 2025 urged the Trump administration to tighten restrictions around networking manufacturer TP Link over concerns around the security of their products.
A report released on Monday showed consumer-grade devices used in homes and small businesses accounted for about half of the vulnerabilities found in networking equipment.
Some industry experts warn the FCC decision will set off unintended consequences.
Researchers at GreyNoise Intelligence, a firm that provides threat information to the cybersecurity community, called the decision “fundamentally flawed,” citing the lack of any U.S. production capability for consumer-grade routers.
“The vast majority of internet routers are assembled or manufactured outside the US, often in Taiwan or China,” Bob Rudis, VP of data science at GreyNoise Intelligence, told Cybersecurity Dive. “Products labeled "made in the U.S." are most likely only assembled domestically, with printed circuit boards manufactured elsewhere.”
Even when chips are designed in the U.S., the silicon underlying the chip is fabricated in South Korea or Taiwan, Rudis noted.
Editor’s note: Updates with comment from GreyNoise Intelligence.
