Am I really at risk, and anymore than I would be with something from Linksys or Netgear?
As always, depends on your threat model. I have cheap TPLink switch in my home network because its cheap and kept behind a pfsense firewall. The TPLink switch is not allowed to talk to the internet. This is good enough for me as I don’t have a threat model where something attacks the switch from inside my network.
For completeness here are Cisco’s and Netgear’s vulnerabilities. Infosec security is a journey, not a destination.
Thank you for that! I’m keeping the cvedetails link bookmarked.
My two devices, the Archer BE9300 router and the TL-WA3001 AP aren’t listed with any known vulnerabilities, though I suppose it may be they haven’t been tested. The BE9300 is pretty popular though so that would be surprising.
The known vulnerabilities in their other devices don’t appear malicious or any worse than other common vendors either however. Given the state of the US government and its desire to monitor it’s citizens, I can’t decide if it’s contempt for TP-Link is a bad thing or not. They might just be mad they can’t get the vendor to give them a backdoor.
Here are two new vulnerabilities from this month.
Here are some more exploits from 2023
Here are all the TPLink vulnerablies known publicly
As always, depends on your threat model. I have cheap TPLink switch in my home network because its cheap and kept behind a pfsense firewall. The TPLink switch is not allowed to talk to the internet. This is good enough for me as I don’t have a threat model where something attacks the switch from inside my network.
For completeness here are Cisco’s and Netgear’s vulnerabilities. Infosec security is a journey, not a destination.
Thank you for that! I’m keeping the cvedetails link bookmarked.
My two devices, the Archer BE9300 router and the TL-WA3001 AP aren’t listed with any known vulnerabilities, though I suppose it may be they haven’t been tested. The BE9300 is pretty popular though so that would be surprising.
The known vulnerabilities in their other devices don’t appear malicious or any worse than other common vendors either however. Given the state of the US government and its desire to monitor it’s citizens, I can’t decide if it’s contempt for TP-Link is a bad thing or not. They might just be mad they can’t get the vendor to give them a backdoor.
I will add the following:
US was looking at this before Trump took office (Dec 2024)
https://www.itpro.com/security/the-us-could-be-set-to-ban-tp-link-routers
TP Link’s sloppy security lead to the creation of a Chinese botnet.
https://cybernews.com/security/chinese-hackers-hijacked-thousands-of-tp-link-wifi-routers/