FCC Blocks New Foreign Consumer Router Models Citing Serious Security Risks

On March 23, 2026, the Federal Communications Commission (FCC) officially updated its Covered List to ban all new consumer-grade routers produced in foreign countries from receiving equipment authorisation.

This regulatory action, driven by a White House-convened Executive Branch interagency determination, aims to mitigate severe cybersecurity risks and supply chain vulnerabilities threatening U.S. critical infrastructure.

The prohibition effectively blocks these new devices from being imported, marketed, or sold within the United States, marking a significant shift in hardware supply chain regulation.

The Cybersecurity Threat Landscape

The security mandate follows documented exploitation of security gaps in foreign-made routers by malicious actors.

These hardware vulnerabilities have been actively leveraged to attack American households, disrupt networks, facilitate intellectual property theft, and enable widespread espionage.

Notably, foreign-made routers were identified as key components in the Volt, Flax, and Salt Typhoon cyberattacks, which specifically targeted vital U.S. infrastructure.

The Executive Branch determined that these devices introduce a severe cybersecurity risk that could be exploited to immediately and severely disrupt national defense and the U.S. economy.

This defensive posture aligns directly with President Trump’s 2025 National Security Strategy, which emphasizes securing independent and reliable access to core technological components.

Under the Secure and Trusted Communications Networks Act, the FCC implements updates to the Covered List strictly at the direction of national security authorities.

Communications equipment placed on this list is legally deemed an unacceptable risk to the safety and security of U.S. persons.

Because most electronic devices require FCC equipment authorization prior to commercial distribution, this listing prevents new foreign router models from entering the U.S. market.

FCC Chairman Carr stated that this regulatory action is a critical step in ensuring that U.S. cyberspace and hardware supply chains remain safe.

Furthermore, the Cybersecurity and Infrastructure Security Agency (CISA) encourages organizations to incorporate the Covered List into their internal risk management analysis and compliance efforts.

Consumer Impact and Regulatory Exemptions

The newly imposed restrictions apply exclusively to new device models seeking authorization by operation of the FCC’s rules.

The FCC emphasised that this mandate does not impact consumers’ continued use of previously lawfully acquired routers.

Retailers are also permitted to continue selling, importing, or marketing older router models that successfully navigated the FCC’s equipment authorisation process before this ruling.

To accommodate secure hardware, the determination includes a specific exemption mechanism. Producers of consumer-grade routers can obtain a “Conditional Approval” from the Department of War (DoW) or the Department of Homeland Security (DHS).

Manufacturers that prove their devices do not pose unacceptable security risks can continue receiving FCC authorisations by submitting applications to conditional-approvals@fcc.gov.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.