TP-Link Omada
Report IMRS-TPL-OMADAMethod: public-record scoring
Apr 2026
Is the TP-Link Omada safe?
No. This router leaves your home network open.
It has 0 of the 8 protections we check in full, it’s made in China by a Chinese-owned company, and it has 3 serious security findings.
$20 off for router checkers. $179.99 with code CHECKED20, applied at checkout.
What this means for you
The top 3 risks, most serious first.
-
Serious
Chinese state hackers have used TP-Link routers to attack US networks
Chinese state hackers used TP-Link equipment as attack infrastructure targeting US government and military networks. The Omada business line shares TP-Link's corporate ownership and legal jurisdiction.
Do this: Replace TP-Link Omada with a platform outside Chinese legal jurisdictionSource: CISA Advisory AA23-144A · 2023 ↗ -
Serious
The US government is investigating the company behind it
The DOJ and FCC investigations cover TP-Link's full corporate structure, including business lines. A forced sale or ban would affect Omada continuity and support.
Source: DOJ/FCC · 2024–present -
Serious
The FCC now blocks new models from this maker
FCC has blocked new TP-Link models from authorization. This affects long-term viability of Omada deployments.
Source: FCC DA 26-278 · 2024
Show 1 more findingShow fewer
-
Moderate
Chinese law can force its maker to help Chinese intelligence
Chinese law requires TP-Link to cooperate with intelligence requests. For business and DIB-adjacent deployments, this is a direct compliance and counterintelligence risk.
Source: China NI Law · Art. 7 · 2017
Protections it’s missing
Missing 5 of 8. Has 3 only partly.
We check every router for the same 8 protections. Here is how the TP-Link Omada does.
-
Blocks unknown devices from joining
MissingNew devices stay out until you approve them once, even if they have the Wi-Fi password.
Zero-Trust Device Admission -
Encrypts internet traffic for every device
MissingTraffic leaving your home is encrypted, even from devices that can’t run a VPN app.
Router-Level VPN -
Locks a device to approved sites
MissingA device can reach only the sites you approve. Everything else is blocked.
Domain Allowlisting -
Guest access that expires
MissingGuests are removed when they leave and need your approval to reconnect.
Guest Auto-Expiry -
Made outside China’s legal reach
MissingNot subject to China’s National Intelligence Law.
Clean Supply Chain -
Keeps smart gadgets away from your computers
PartlyDevices are kept apart, so a hacked smart TV can’t reach your laptop.
Network Segmentation (VLANs) -
Separate Wi-Fi passwords per group
PartlyEach part of your network gets its own password.
Granular Password Control -
Watches for attacks in real time
PartlySpots suspicious devices, traffic and known attacks as they happen.
Active Threat Monitoring
Fix it today
- Replace TP-Link Omada with a platform outside Chinese legal jurisdictionWhy: Chinese state hackers have used TP-Link routers to attack US networks.
- Review compliance requirementsDFARS/CMMC may prohibit Chinese networking equipment.
- Audit all TP-Link equipment in the deploymentThe federal investigation covers the full product family.
Rio closes the gaps your Omada leaves open.
- You approve every device. Nothing new joins your network until you say yes in the Rio app.
- US company, made in Taiwan. No government flags.
- Rio VPN for the rooms you choose. 3,000+ servers in 110+ countries. First year included.
$20 off for router checkers with code CHECKED20, applied at checkout. Regular price $199.99.
1 year of Rio VPN included, then $7.99/month or $79.99/year · 30-day returns · 1-year warranty
Rio builds this site and is graded by the same method. See the method
Get alerts for your Omada
Get an email if it shows up on the US government's list of actively exploited flaws, or loses updates. Plus the 5-step lockdown checklist now.
How we scored it70% from who makes it, FCC status and updates. 30% from the 8 protections.
1Scores
2Calculation
10 × 0.7 + 19 × 0.3 = 13/100, grade F. 85+ is an A, 65+ a B, 45+ a C, 30+ a D, below 30 an F.
3The facts behind it
- Who makes it
- Chinese-ownedTP-Link Technologies Co., Ltd., Shenzhen, China
- Made in
- China
- Security updates
- Active (parent co. under investigation)
- FCC approval
- Authorized - under federal review
- FCC restrictions
- New models blocked from FCC authorization ↗
- Last verified
- April 2026
4Known flaws in TP-Link routers
From the NIST National Vulnerability Database. Your specific model may or may not be affected.
- CVE-2023-1389 · High · CVSS 8.8 · Archer AX21
Command injection via country form parameter. CISA Known Exploited Vulnerabilities (KEV) listed April 2023. Actively exploited in the wild. - CVE-2022-4499 · High · CVSS 7.5 · TL-WR940N, TL-WR841N
Side-channel timing attack allows remote recovery of admin credentials - no authentication required. - CVE-2022-42402 · Medium · CVSS 6.5 · Multiple models
Authenticated remote command execution via crafted HTTP request.
5Sources
- CISA Advisory AA23-144A · 2023 ↗
- FCC Equipment Authorization Database ↗
- FCC Covered List · National Security Designation ↗
Every finding traces to public sources: FCC filings, NIST CVE records and US government advisories. Read the full method · Report an error
Other TP-Link models
See all 28 TP-Link models
See every TP-Link model: TP-Link brand overview →