Security Experts:

Connect with us

Hi, what are you looking for?



FTC Sues D-Link Over Failure to Secure Cameras, Routers

The U.S. Federal Trade Commission (FTC) has filed a lawsuit against Taiwan-based networking equipment provider D-Link, accusing the company of making deceptive claims about the security of its products, particularly IP cameras and routers.

The U.S. Federal Trade Commission (FTC) has filed a lawsuit against Taiwan-based networking equipment provider D-Link, accusing the company of making deceptive claims about the security of its products, particularly IP cameras and routers.

The FTC said D-Link’s promotional materials and device interfaces advertise products as being highly secure, but in reality, the company has failed to address flaws and it has put consumers at risk.

The examples provided by the FTC include the existence of hardcoded credentials that allow access to live camera feeds, leaving login credentials unprotected, the accidental disclosure of private code signing keys, and failure to patch serious vulnerabilities that can be exploited to hijack devices.

D-Link has been accused of several FTC Act violations, including misrepresentations about security in router and IP camera user interfaces and promotional materials, falsely claiming that reasonable steps have been taken to prevent unauthorized access to devices, and failure to secure software.

“Hackers are increasingly targeting consumer routers and IP cameras — and the consequences for consumers can include device compromise and exposure of their sensitive personal information,” stated Jessica Rich, director of the FTC’s Bureau of Consumer Protection. “When manufacturers tell consumers that their equipment is secure, it’s critical that they take the necessary steps to make sure that’s true.”

Several researchers reported finding serious vulnerabilities in D-Link products over the past year, and while some were satisfied with how D-Link addressed issues, others decided to disclose unpatched flaws due to the vendor’s failure to release firmware updates in a timely manner.

D-Link is not the only Taiwanese router manufacturer targeted by the FTC. In February, the agency announced that it had reached a settlement with Asus, after the vendor agreed to establish a security program and implement a system to ensure that customers can stay informed on vulnerabilities and the availability of patches.

Earlier this week, the FTC announced the launch of the IoT Home Inspector Challenge, which aims to find technical solutions for securing IoT devices. The winner of the contest will receive $25,000.

UPDATE. D-Link has responded to the FTC complaint saying that it denies the unwarranted allegations outlined in the FTC complaint and will vigorously defend the action.

“The FTC complaint alleges certain security hacking concerns for consumer routers and IP cameras, and we firmly believe that charges alleged in the complaint against D-Link Systems are unwarranted,” said William Brown, D-Link’s chief information security officer. “We will vigorously defend the security and integrity of our routers and IP cameras and are fully prepared to contest the complaint. Furthermore, we are continually working to address the overall security features of D-Link Systems’ products for their intended applications and to regularly inform consumers of the appropriate steps to take to secure devices.

Related: FCC, FTC Investigate Mobile Device Patching Practices

Related: Oracle Settles FTC Charges Over Java Security Updates

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...