Security Analysis Report

TP-Link Deco W3600

Last reviewed: March 2026 · ismyroutersafe.com

TP-Link Made in China
Permanent URL - bookmark it or forward it
F
HIGH RISK
TP-Link's budget mesh SKU. Newer hardware does not change the ownership risk — the DOJ investigation and Chinese state jurisdiction apply to every TP-Link model. The Texas AG action and FCC DA 26-278 both cite TP-Link's corporate structure, not specific products.
  • Volt Typhoon — TP-Link named by FBI and CISA: Chinese state hackers built a botnet using TP-Link routers to attack US military, government, and infrastructure. The Deco line shares TP-Link firmware architecture.
  • Federal investigation — forced sale or ban: Active DOJ and FCC investigations into TP-Link's corporate structure. Forced divestiture or ban is under active review.
  • Texas AG action alongside FCC DA 26-278: State-level enforcement against TP-Link has begun alongside federal regulatory pressure. Neither action is model-specific.
  • Chinese National Intelligence Law: Legal obligation to cooperate with PRC intelligence applies to all TP-Link products.
FCC & Ban Risk
10 /100 F
Supply chain · FCC status · CVEs · Patch support
Security Capabilities
19 /100 F
Zero-Trust · VPN · Segmentation · Monitoring
🏭  Manufacturer
Chinese-owned
TP-Link Technologies Co., Ltd., Shenzhen, China
Manufactured in: China
🏛️  FCC Status
Authorized - under federal review
🛡️  Patch Support
Active (parent co. under investigation)
Whether security vulnerabilities are actively being patched
⚠️  Key Finding
critical
Volt Typhoon — TP-Link named by FBI and CISA
Live Network Check BETA

The report above reflects your router’s model record. This check runs live probes against your current network to detect issues static analysis cannot - DNS hijacking and admin interface exposure.

🔍
DNS HIJACK CHECK
Detects if your DNS has been silently rerouted to intercept your traffic
🌐
WAN EXPOSURE
Tests if your router admin panel is reachable from outside your home
No data stored · Runs entirely in your browser · ~5 seconds
🔒 Security capabilities comparison
We benchmark your router against Rio Router across 8 dimensions so you can see exactly what gaps exist - and what a fully-covered setup looks like.
TP-LINK
your router
Rio Router
full standard
Zero-Trust Device Admission
Every new device is blocked by default - admin must approve it once, even if it has the right password
Not available
Available
Network Segmentation (VLANs)
Devices on your network are isolated from each other, so a hacked smart TV can't reach your laptop
Partial
Available
Router-Level VPN for All Devices
All traffic - including smart devices that can't run VPN apps - is encrypted before leaving your home
Not available
Available
Domain Allowlisting
Block everything except approved sites; more effective than trying to blacklist billions of harmful URLs
Not available
Available
Granular Password Control
Separate passwords per network zone - changing one doesn't affect others
Partial
Available
Guest Auto-Expiry
Guest devices are automatically removed when they leave; neighbors can't reconnect without re-approval
Not available
Available
Clean Supply Chain
Manufactured outside Chinese legal jurisdiction - not subject to China's National Intelligence Law
Not available
Available
Active Threat Monitoring
DNS filtering, firewall, activity logs, and ongoing security patch support
Partial
Available
We use Rio Router as the benchmark because it’s the only consumer router built to score 8/8 on this framework - it shows you what a fully-covered setup looks like, not just what’s typical. See Rio →
📋 What you should do
1
Replace — newer hardware from the same manufacturer does not reduce risk
2
Update firmware if keeping temporarily
3
Disable remote management and UPnP
New model, same owner, same federal investigation.
Replacement Guide →
How this was scored · verified March 2026: This rating combines FCC authorization status, manufacturer legal jurisdiction, CVEs from NIST NVD, active patch support status, and CISA advisory mentions. See full methodology →
Reference Data
Known CVEs - TP-Link brand history
From the NIST National Vulnerability Database. Your specific model may or may not be affected.
CVE-2023-1389 High · CVSS 8.8 Archer AX21
Command injection via country form parameter. CISA Known Exploited Vulnerabilities (KEV) listed April 2023. Actively exploited in the wild.
CVE-2022-4499 High · CVSS 7.5 TL-WR940N, TL-WR841N
Side-channel timing attack allows remote recovery of admin credentials - no authentication required.
CVE-2022-42402 Medium · CVSS 6.5 Multiple models
Authenticated remote command execution via crafted HTTP request.
Other TP-Link models
Archer AX21 F Active (parent co. under investigation)
Archer AX55 F Active
Archer AX73 F Active
Archer C7 F End of security support
Deco XE75 F Active
Archer BE800 F Active
Deco M5 F Limited
Deco W7200 F Active (parent co. under investigation)
Deco XE200 F Active (parent co. under investigation)
Deco BE85 F Active (parent co. under investigation)
Archer AX6000 F Active (parent co. under investigation)
Archer AX11000 F Active (parent co. under investigation)
Archer AX3000 F Active (parent co. under investigation)
Archer AXE75 F Active (parent co. under investigation)
Deco X20 F Active (parent co. under investigation)
Deco X55 F Active (parent co. under investigation)
Archer AX1500 F Active (parent co. under investigation)
Omada F Active (parent co. under investigation)
ER605 F Active (parent co. under investigation)
Archer AX1800 F Active (parent co. under investigation)
Sources & evidence
All findings trace to publicly verifiable primary sources - US government databases, official FCC filings, and NIST CVE records. No proprietary or anonymous sources are used.
  1. CISA Advisory AA23-144A · 2023 ↗
  2. FCC Equipment Authorization Database ↗
  3. FCC Covered List · National Security Designation ↗
Full data source documentation: Scoring Methodology & Citations →
A free public tool made with 🦾 by Rio