FCC Bans Foreign-Made Routers Over Cybersecurity Risks

In a sweeping move to protect U.S. communications infrastructure, the Federal Communications Commission (FCC) has banned the import of new foreign-made consumer routers, citing unacceptable risks to national security and cyber resilience.

What’s Changing

Effective March 2026: New foreign-made consumer routers are no longer eligible for sale or marketing in the U.S.
Covered List expansion: All foreign-manufactured consumer routers added unless granted Conditional Approval by the Department of War (DoW) or Department of Homeland Security (DHS).
Exemptions:
- Starlink routers (made in Texas)
- Select drone and SDR systems from SiFly Aviation, Mobilicom, ScoutDI, and Verge Aero

Why This Matters

Supply chain vulnerability: Foreign routers could be weaponized to disrupt critical infrastructure and enable espionage.
Botnet abuse: Threat actors have used compromised routers to build botnets for password spraying, network infiltration, and proxy-based attacks.
State-sponsored threats: Groups like Volt Typhoon, Flax Typhoon, and Salt Typhoon have exploited foreign routers to target U.S. energy, water, and transportation systems.
Storm-0940’s botnet: The CovertNetwork-1658 (Quad7) botnet has been linked to evasive attacks using foreign routers.

FCC’s Justification

According to the National Security Determination (NSD):

Foreign routers pose a “severe cybersecurity risk”
They enable “long-term access” and “pivoting” across networks
They’ve been used to compromise households, steal IP, and surveil networks

What Consumers and Enterprises Should Know

Existing routers: Already purchased devices are unaffected.
Retailers: Can continue selling previously approved models.
Manufacturers: Must apply for Conditional Approval to continue U.S. sales.
Security teams: Should audit router fleets and block known botnet domains.

Final Thought

The FCC’s router ban is a bold step toward supply chain hardening and network hygiene. As routers sit at the edge of every digital interaction, securing them is no longer optional — it’s foundational. Organizations must treat router selection as a strategic decision, not just a procurement line item.