GoKawiilThe Federal Communications Commission (FCC) has eased some of its recent restrictions on foreign-made consumer routers and will now allow vendors of these products to continue issuing software and firmware updates for already-deployed devices in the US through at least January 2029.
The decision modifies a March 2026 FCC ruling that prohibits foreign manufacturers from selling new consumer router models in the US, except for those the agency had already approved. The FCC cited national security concerns as its primary justification for adding foreign-made small office and home office routers to its list of prohibited equipment and noted how adversaries, including nation-state groups, have used routers to facilitate attacks against US organizations.
A Major Reprieve for Router Owners?
Under the original FCC ruling, foreign manufacturers were permitted to provide only limited maintenance and security patches to US customers through March 2027.
Related:VoidStealer Malware Darts Past Google Chrome's Encryption
In a public note on May 8, the FCC extended that deadline to at least January 2029 and also expanded the scope of permissible updates. The FCC will now allow foreign manufacturers to provide not just minor security fixes and changes, but also more major software and firmware updates that could affect router functionality, which previously required additional FCC review. The agency described the revisions as intended to ensure the continued safety of already deployed foreign-made consumer routers in the US.
The agency's decision is a major reprieve for the millions of US consumers and small and medium-sized businesses currently using the affected class of devices, because it buys them more time to find alternatives. Analysts have noted how almost all consumer grade routers currently available in the US are made by foreign manufactuers.
Infosec professionals have expressed concern over how the FCC's ban would essentially leave users of these devices with no choice but to continue using aging and unsupported devices for the foreseeable future, ironically making them more vulnerable to attacks and compromise, not less. Many have also noted how the real issues with router security are not really about where the devices are manufactured but more about operational risks, such as using default passwords and configurations, and not keeping up with security patches.
"The FCC likely issued this revision in response to the operational realities of network security and the slow pace of equipment replacement," says Jason Soroko, senior fellow at Sectigo. "Replacing millions of embedded devices across national infrastructure requires immense time and capital, and abandoning existing systems to a completely unpatched state would create an immediate vulnerability."
Related:Silver Fox Springs Tax-Themed Attacks on Orgs in India, Russia
... continue reading