On October 6, 2026, the Florida Attorney General filed a Deceptive and Unfair Trade Practices Act complaint against TP-Link Systems Inc., the Irvine, California company, in the Circuit Court of the Tenth Judicial Circuit in Polk County. Iowa filed a parallel petition the same day on the same facts. Coverage led on the China allegations; the operationally useful part is narrower. The Iowa petition pleads that leaving models in service without security support is an unfair practice, and both complaints name the same three routers — the TL-WR940N, the Archer C7, and the Archer AX21.
The CVE numbers were already past their federal deadline
CVE-2023-1389 is command injection in the country parameter of /cgi-bin/luci;stok=/locale on the Archer AX21 — unauthenticated, running as root, fixed in firmware 1.1.4 Build 20230219. CISA added it to KEV on May 1, 2023 with a federal remediation deadline of May 22, 2023, three years and four months before Florida filed. CVE-2023-50224 is credential disclosure in the httpd service, which listens on TCP 80 by default; it was added on September 3, 2025 with a deadline of September 24, 2025, and its required action is not "patch" but "Apply mitigations per vendor instructions ... or discontinue use of the product if mitigations are unavailable."
There is a trap in checking this yourself. KEV's Product column for CVE-2023-50224 reads "TL-WR841N." The Iowa petition states TP-Link has admitted the CVE affects the TL-WR940N, and the NVD configuration for the same record lists roughly forty TP-Link models, the TL-WR940N and Archer C7 v2 and v3 among them. Grep that column for your own model and you would conclude you were unaffected. KEV membership is a poor trigger for your own patch decisions partly for this reason: its fields describe the exploitation, not your inventory.
The support window is arithmetic on two published dates
TP-Link's End-of-Life Policy states it plainly — "TP-Link discontinues support and maintenance, including security updates, for such products" — and defines two milestones. End of Sales (EOS) is when new orders stop. End of Maintenance (EOM) is when support stops, and "the EOM date is usually 3 years after the EOS date." So "does this router still get firmware" has a published answer: find the model and hardware version on the end-of-sale list, then add three years.
Run it on the models the states named, using TP-Link's own US end-of-sale list for home products, version 9, dated September 21, 2026. Archer C7 v2.0 and v3.0 show an end-of-sale date of "Before 2018" — the vendor cannot state a year. TL-WR940N v3.0 went end of sale on November 30, 2020; v6.8 on May 7, 2022; v6.0 and v6.6 on April 23, 2024. Archer AX21 v1.20 through v2.6 went end of sale on May 29, 2024, while the v4.6 and v5.6 revisions sold today carry a published end-of-sale date of February 14, 2027. On the TL-WR940N alone, the hardware revision stamped on the label moves the answer by three years and five months.
Two caveats on the arithmetic. TP-Link uses "EOS" for End of Sales on the policy page and for End of Service on its security advisory for these models, where it says the affected products "have reached their End of Service (EOS) and are no longer receiving active support, including security updates." Same acronym, two meanings, and the three-year window sits between them. The three years is discretionary too: the policy lets TP-Link extend maintenance, which equally means it may not.
When the patch exists and nothing delivers it
On November 8, 2024, TP-Link published patched firmware for products it had already declared end of service — Archer C7(EU) V2, TL-WR841N(MS) V9 and TL-WR841ND(MS) V9 — as three zip files on static.tp-link.com. The Iowa petition alleges the TL-WR940N and both versions of the Archer C7 do not support automatic firmware updates. So the fix is written and hosted, and nothing on the device will ever fetch it. That is a different failure from an unpatched vulnerability, and the one that survives in a branch office for a decade.
Doing this inventory costs an afternoon per site, and the honest output is often a replacement date rather than a patch ticket — a capital line someone has to approve. Where you cannot replace a device this quarter, take its management plane off the internet. TP-Link's own advice on that advisory is to avoid remote management, and CVE-2023-50224 lives in a service listening on port 80.
# From outside, against the WAN address of each site
nmap -Pn -p 80,443,8080,7547,22,23 <wan-ip>
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 5 http://<wan-ip>/
How to check
- Record the model and hardware version from the label of every router and gateway on a perimeter or branch site, then look each up on the vendor's end-of-sale list and add its stated maintenance interval.
- Find the automatic-update setting in the admin UI. If it is not there, mark the device manual-only: its firmware stays whatever shipped unless a person intervenes.
- List the devices nobody bought on a purchase order, ISP-supplied gear especially. The Iowa petition describes TP-Link's Aginet line as ISP-managed routers, gateways and modems that providers distribute directly to homes and small businesses — the update decision there belongs to the provider. A second list finds the devices the first one missed.
- Scan the WAN side of each site for a reachable admin interface, not only the LAN side.
- For anything already past maintenance, date the gap instead of describing it. A number gets budget in a way "legacy" does not.
North InfoSec runs AI-assisted penetration testing and security assessments, including edge-device inventory and firmware end-of-support exposure. northinfosec.com