FCC bans foreign routers with security flaws

Key Takeaways

• The Federal Communications Commission (FCC) has updated its Covered List to prohibit new foreign-made consumer-grade network routers from entering the U.S. market.
• This ban stems from a determination by a White House interagency body that these devices pose an unacceptable national security risk due to exploitable vulnerabilities.
• The restriction is forward-looking, impacting only new router models seeking FCC authorization; existing devices and previously approved models remain unaffected.
• A conditional approval process allows manufacturers to seek exemptions from the Department of War (DoW) or Department of Homeland Security (DHS) if a device is deemed secure.

FCC Blocks New Foreign Routers Citing National Security Risks

The Federal Communications Commission (FCC) has implemented a significant policy change, effectively blocking new foreign-manufactured consumer-grade network routers from entering the U.S. market. This regulatory update prevents these devices from receiving the mandatory FCC equipment authorization, a critical step for sale and distribution within the United States.

This stringent measure follows a comprehensive assessment by an Executive Branch interagency body, convened by the White House, which concluded that certain foreign-made routers present an unacceptable risk to U.S. national security and public safety. The ban directly confronts persistent vulnerabilities within the global hardware supply chain and aims to mitigate the escalating threat posed by nation-state cyber operations.

According to the Executive Branch’s findings, malicious actors have repeatedly exploited security weaknesses in routers produced overseas. These vulnerabilities have been weaponized in various attacks, impacting American households, disrupting local networks, facilitating espionage, and enabling the theft of intellectual property.

Driving Factors Behind the Ban

Compromised foreign-made routers have been implicated in several high-profile cyber campaigns, including the Volt, Flax, and Salt Typhoon operations, which specifically targeted critical U.S. infrastructure. This policy adjustment aligns with the broader objectives of the 2025 National Security Strategy, which prioritizes reducing the nation’s reliance on foreign powers for essential technological components.

Operating under the provisions of the Secure and Trusted Communications Networks Act, the FCC is mandated to execute determinations made by national security agencies and lacks the authority to independently modify the Covered List. By preventing these routers from entering the market, the U.S. government intends to eliminate a primary vector utilized by advanced persistent threats (APTs) to undermine the U.S. economy and national defense systems.

To ensure clarity regarding the scope of this prohibition, the FCC has precisely defined the devices affected by the updated Covered List. The restrictions are prospective, applying exclusively to new hardware models seeking to enter the market. All new foreign-made router models are now barred from receiving FCC equipment authorizations under these new rules.

However, the new regulations do not impact existing home routers already in use by consumers, who can continue operating their devices without concern. Similarly, retailers are still permitted to import, market, and sell previously approved models that successfully navigated the FCC authorization process prior to this ruling. Furthermore, specific foreign models that secure Conditional Approval from national security agencies may still be permitted to enter the market.

Conditional Approval Process

To mitigate potential disruptions to the consumer electronics market and accommodate global manufacturers, the determination includes an official exemption mechanism. Producers of foreign-made consumer-grade routers can apply for a Conditional Approval from either the Department of War (DoW) or the Department of Homeland Security (DHS).

Should these federal security agencies, following a rigorous review, conclude that a particular device does not present an unacceptable security risk, the FCC will then grant the necessary equipment authorization. Manufacturers seeking this exemption are advised to submit their security documentation and applications directly to the FCC at [email protected].

What You Should Do

• If you are a consumer, continue using your existing router as the ban only affects new models entering the market.
• If you are a retailer or distributor, verify that any foreign-made router models you sell were approved by the FCC prior to this new ruling.
• If you are a manufacturer of foreign-made routers, review the conditional approval process and submit your security documentation to the FCC if you wish to seek an exemption.
• Stay informed about FCC announcements and guidelines regarding network equipment.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.