The FCC has stopped new foreign-made routers from being sold because of worries about the supply chain and cyber security.

On Monday, the U.S This article explores foreign consumer routers. . Federal Communications Commission (FCC) said it was stopping the import of new, foreign-made consumer routers because they pose "unacceptable" risks to national and cyber security.

Brendan Carr, the chairman of the FCC, said in a post on X that the action was meant to protect Americans and the communications networks that the country depends on. This means that new models of routers made outside the U.S. will no longer be able to be sold or marketed there. Carr said the move was made after Executive Branch Agencies made a decision about national security.

To that end, all consumer-grade routers made in other countries have been added to the Covered List. The only exceptions are those that the Department of War (DoW) or the Department of Homeland Security (DHS) has given Conditional Approval to after deciding that they don't pose any risks. The approved list only has drone systems and software-defined radios (SDRs) from SiFly Aviation, Mobilicom, ScoutDI, and Verge Aero as of this writing.

Companies that make consumer-grade routers can apply for Conditional Approval. Starlink Wi-Fi routers are not subject to the policy because they are made in Texas, according to BBC News. The decision from the Executive Branch said that routers made in other countries (1) create "a supply chain vulnerability that could disrupt the U.S."

The FCC said that (1) "pose a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons" and (2) "pose a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons." The agency said that both state and non-state sponsored threat actors have taken advantage of security holes in small and home office routers to break into homes, disrupt networks, steal intellectual property, and spy on people online.

Also, these devices could be used in huge networks to do password spraying and get into networks without permission, as well as serve as proxies for spying.

Volt Typhoon, Flax Typhoon, and Salt Typhoon are some of the China-nexus groups that have used botnets made up of foreign-made routers to attack important American communications, energy, transportation, and water infrastructure. The National Security Determination (NSD) says that "In Salt Typhoon attacks, state-sponsored cyber threat actors used compromised and foreign-produced routers to jump to embed and gain long-term access to certain networks and pivot to others depending on their target." The U.S. government also talked about a botnet called CovertNetwork-1658 (also known as Quad7), which has been used to carry out very sneaky password spray attacks.

Storm-0940, a Chinese hacker group, is thought to be behind the activity.

It's important to remember that the Covered List update doesn't stop customers from using routers they already bought. It also doesn't affect retailers, who can still sell, import, or market router models that the FCC has already approved through its equipment authorization process. "Unsecure and foreign-made routers are prime targets for attackers and have been used in several recent cyber attacks to let hackers get into networks and use them as launching pads to compromise critical infrastructure," the NSD said.

"The security holes that foreign-made routers create in American networks and important infrastructure are not acceptable." Cybercriminals have been targeting routers because they are the main way to get on the internet.

Threat actors could use compromised routers to spy on networks, steal data, and even send malware to victims. In his 2014 book No Place to Hide, journalist Glenn Greenwald claimed that the U.S. National Security Agency (NSA) routinely intercepts routers before they can be exported by U.S. manufacturers to put in backdoors.