FCC extends waiver on foreign-made router updates to 2029, averting major security risks

What happened

Recognizing the unintended consequences of this approach, the FCC quietly extended waivers until January 1, 2029, allowing continued updates on impacted devices. This extension helps prevent a significant security gap where millions of routers could have been frozen in time without vulnerability patches, undermining the very network safety the regulation sought to protect.

Why it matters

Routers play a critical role in managing network traffic and safeguarding internet connections. Vulnerabilities in outdated firmware have historically been exploited in high-profile cyberattacks, affecting not only consumers but also enterprises and critical infrastructure. The ban on foreign router updates risked allowing exploitable flaws to persist unpatched, increasing the attack surface and potentially enabling long-term threats.

Security experts praised the FCC's move as a necessary correction, emphasizing that the origin of a device is less relevant than its ability to receive timely security updates. Stopping updates would have effectively left consumers with insecure equipment, contradicting the FCC's goal of reducing network risks. The decision balances national security concerns against practical risks to device security and user safety.

What to watch next

Stakeholders should monitor how the FCC enforces these manufacturing requirements and whether foreign manufacturers adapt by relocating operations to the US. Additionally, ongoing updates to security policies will be necessary to address evolving cyber threats while maintaining access to timely firmware patches for existing network devices.