On 23 March 2026, the US Federal Communications Commission added a whole category of product to its Covered List: consumer-grade routers produced outside the United States. Because nearly all home routers are made abroad, the headlines read like a ban on almost every router on the market. The reality is narrower, and more interesting. Your current router isn’t illegal, shops can still sell existing models, and several big brands have already been cleared to launch new ones.
Here’s what the FCC actually did, why, and what it means if you own or are about to buy a router.
What the Covered List is
The Covered List is maintained under the Secure and Trusted Communications Networks Act of 2019. It lists communications equipment and services that federal national security agencies have determined pose an unacceptable risk. It first became widely known for including Huawei and ZTE telecom equipment.
Being on the list matters mainly because of a second law, the Secure Equipment Act of 2021, which led the FCC to stop granting new equipment authorizations to covered equipment. Nearly every electronic device that emits radio signals needs FCC authorization before it can be marketed in the US. No authorization, no new product on shelves.
What changed in March 2026
According to Davis Wright Tremaine’s analysis, a White House-convened interagency body made a national security determination on 20 March 2026 that consumer routers produced in foreign countries pose an unacceptable risk. The FCC added them to the Covered List three days later.
Unlike earlier entries, this one isn’t aimed at named companies. As the FCC’s follow-up guidance put it, the addition targets equipment by place of production, not by entity. So a router designed by a US company but assembled overseas falls under it, as does one made by a foreign firm.
The FCC’s stated rationale, as summarised by Cooley, pointed to state-backed hacking campaigns such as Volt Typhoon and Salt Typhoon. Those campaigns used compromised network devices, including home and small-office routers, as footholds and relay points.
What’s covered, and what isn’t
The FCC revised its FAQs on 31 March to clear up the scope. According to Wiley’s summary:
- Covered: routers primarily intended for residential use that customers can install themselves, including combined modem-router gateways. They’re covered even when an ISP or professional installs them.
- Not covered: industrial, enterprise and military routers, and phones with a mobile hotspot feature.
What it means for routers already on the market
This is the part many early reports got wrong.
- Routers you already own: you can keep using them. Nothing requires you to remove or replace them.
- Models already authorized: these can continue to be sold in the US. The restriction applies to new models seeking authorization.
- Firmware updates: an FCC waiver lets previously authorized models keep receiving software and firmware updates to maintain usability, currently until 1 March 2027. That matters, because firmware updates are how security holes get fixed.
The Conditional Approval route
Manufacturers can still get new models authorized by obtaining Conditional Approval, granted through the Defense Department or the Department of Homeland Security. Applicants have to provide bills of materials and a detailed, time-bound plan to establish or expand manufacturing in the United States, with ongoing progress updates. Approvals can cover a company’s whole range rather than one model at a time.
Several major brands moved quickly. As Tom’s Hardware reported in April 2026, Netgear and Amazon’s eero received Conditional Approvals covering an 18-month period running to 31 October 2027. TP-Link, which holds a large share of the US retail router market, applied for approval and stressed that it is no longer Chinese-owned. The FCC publishes approvals on its Covered List page, and that’s the place to check the current status of any brand.
The practical effect is that the rule works less like a ban and more like leverage: companies that commit to moving manufacturing to the US can keep launching products.
Is the security concern real?
Router security is a real problem, whoever makes the device. Home routers are always on, directly exposed to the internet, often run old software and are rarely updated by their owners. That’s why they keep turning up in botnets and in state-sponsored campaigns. US agencies have published several advisories about hackers compromising end-of-life small-office and home routers to hide their traffic.
Where people disagree is whether place of manufacture is the right lever. Critics point out that most router compromises come from unpatched vulnerabilities and weak default settings, not factory-planted backdoors, and that a US-assembled router with poor firmware support is no safer. Supporters argue that supply chain control matters for national security regardless, and that the conditional approval process gives the government visibility into how devices are built. Law firms advising the industry have also warned about possible disruption to supply and higher costs for ISPs and retailers, though how much prices move remains to be seen.
What home users should actually do
Whatever you think of the policy, the security basics haven’t changed, and they matter far more to your home network than where the router was assembled:
- Keep firmware updated. Turn on automatic updates if your router supports them, or check the manufacturer’s site every few months.
- Replace end-of-life routers. If your router no longer gets security updates, it’s a liability. This is the single most important step.
- Change the admin password. Use a unique password for the router’s admin interface, separate from your Wi-Fi password.
- Turn off remote management unless you really need it, along with UPnP and WPS if you don’t use them.
- Use WPA3 or WPA2 with a strong passphrase, and put smart-home devices on a guest network if your router supports it.
If you’re buying a new router, favour brands with a clear record of long firmware support. For US buyers, also check the FCC’s list for the brand’s Conditional Approval status, since that affects whether new models will keep coming.
For readers outside the US
This rule only applies to devices marketed in the United States. It doesn’t change what you can buy in Pakistan, the UK or anywhere else. It’s still worth watching, though. Manufacturers that move production to meet US rules may change their product lines globally, and other governments have been looking at similar supply chain rules for connected devices.
Related reading
- AirSnitch Explained: How Researchers Broke Wi-Fi Client Isolation
- UNC3886 Inside Singapore’s Telcos
- The Xbox One “Bliss” Hack Explained
Sources: FCC Covered List, FCC announcement, Davis Wright Tremaine, Cooley, Wiley, Tom’s Hardware.
