Free tools Windows power users keep installed
One-click scans. No signup required.
On July 2, 2019, D-Link Systems agreed to resolve Federal Trade Commission litigation over alleged security weaknesses and security claims involving consumer routers and internet-connected cameras. The proposed order required a software-security program lasting up to 20 years, independent assessments for 10 years, and annual management certifications. It did not require a monetary payment. D-Link said the settlement did not find the company liable for the alleged violations.
What the FTC–D-Link settlement was
The FTC filed its original complaint in January 2017 against D-Link Corporation and D-Link Systems. The agency alleged that D-Link marketed routers and IP cameras as secure without taking reasonable steps to protect them. On July 2, 2019, the FTC announced a proposed stipulated order in FTC v. D-Link Corporation et al., Case No. 3:17-cv-00039-JD, in the U.S. District Court for the Northern District of California. The commission voted 5–0 to accept the proposed agreement. The FTC’s announcement and case page describe the timeline and filings.
This was a settlement, not a trial finding that D-Link committed the alleged violations. D-Link said the order did not find D-Link Systems liable and did not find that its marketing was deceptive. Those distinctions matter: the security problems below were allegations in the FTC’s complaint, not findings that every alleged flaw caused consumer harm.
What security weaknesses the FTC alleged
The FTC’s 2017 complaint described several weaknesses it said could expose users or their devices. The FTC’s complaint announcement and the unredacted complaint set out the allegations.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute#1 Best Overall
- AC2600 WiFi Speeds - Watch your favorite movies in 4K, game online, and video chat with friends. The DIR-2640 has plenty of bandwidth along with fast AC2600 dual band Wi-Fi, MU-MIMO and Smart Connect for a smooth, buffer-free online experience.
- More Processing Power - A powerful dual-core processor sits at the heart of your router, accelerating every thread and application with strong performance throughout your network.
- Set Boundaries with Enhanced Parental Controls - Create a profile for each person, then associate devices with each profile to control when and how they access the network. You can even use a profile to control internet access for shared devices, like game consoles and smart TVs.
- More Processing Power - A powerful dual-core processor sits at the heart of your router, accelerating every thread and application with strong performance throughout your network.
- Reliable Gigabit Wired Performance - Connect four devices to enjoy a strong and reliable wired connection with minimal latency - perfect for connecting Android boxes, smart TVs and game consoles.
- Camera credentials: The FTC alleged that software in some cameras included hard-coded credentials, including the username and password “guest,” that could enable unauthorized access to live feeds.
- Router command injection: The complaint alleged that attackers could send unauthorized commands to affected routers remotely.
- Software-signing key: The FTC alleged that a private key used to sign D-Link software was publicly available for about six months.
- Mobile-app credentials: The FTC alleged that login credentials for D-Link’s mobile application were stored in clear, readable text on users’ devices.
- Development and remediation: The agency alleged that D-Link did not adequately test for known, preventable flaws or correct them before release.
The complaint said a compromised router could expose files on attached storage, redirect a user to fraudulent websites, or be used to attack other devices. A compromised camera could expose video or audio and reveal information about people’s homes and routines. These were potential consequences alleged by the FTC, not proof that all affected devices were exploited.
What the order required D-Link to change
The proposed order required D-Link to establish, maintain, and document a software-security program for defined covered devices. It converted the broad term “comprehensive” into operational controls across product development, vulnerability handling, updates, and oversight. The proposed order contains the detailed requirements.
Rank #2
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Security during product development
- Written program policies, documentation, and designated personnel responsible for security.
- Annual risk assessments and planning for product features and functionality.
- Threat modeling and automated static-analysis code review before release.
- Vulnerability testing before every software release for covered devices, with processes to remediate flaws found during development or later.
Monitoring and vulnerability reports
D-Link had to monitor security research and maintain a way for researchers to report vulnerabilities, including a designated contact and supervisory personnel to validate reports. It also had to review and adjust its security program annually, test and monitor safeguard effectiveness each year, and provide security training every two years to relevant employees and vendors. Service providers and contractors were also subject to security requirements.
Firmware updates and end-of-support notices
The order required automatic firmware updates for covered devices configured to receive them. It also required at least 60 days’ notice before ending security updates in specified circumstances, including conditions involving registered devices and product pages. The notice requirement was not a guarantee that every owner, including every second-hand owner, would receive an individualized communication.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- AC1200 dual-band speeds up to 300 Mbps (2.4 GHz) plus 867 Mbps (5 GHz)
- High-Power amplifiers provide wider coverage
- Mesh Smart Roaming connects your mobile devices to the strongest Wi-Fi signal as you roam
- MU-MIMO technology sends data to more devices simultaneously
- Gigabit Ethernet Internet WAN port ready for high-speed internet connections
How long the obligations lasted
The order set three different oversight periods. They should not be conflated: the security program lasted longer than the independent assessment requirement.
| Requirement | Duration or frequency |
|---|---|
| Software-security program | 20 years after entry of the order, unless D-Link stopped marketing, distributing, or selling covered devices. |
| Independent assessments | An initial assessment and assessments covering each two-year period for 10 years. |
| Management certification | Annual certification by a senior corporate manager or responsible senior officer that requirements were implemented and maintained, and that known material noncompliance had been corrected or disclosed. |
The assessments had to be conducted by a qualified, objective, independent assessor. The order specified a Certified Secure Software Lifecycle Professional (CSSLP) with experience involving secure internet-accessible devices; the FTC could approve or reject the selected assessor. Assessors had to retain supporting material for five years and provide it to the FTC upon request. Their work had to identify evidence reviewed, such as documents, testing, sampling, and interviews, and could not rely solely on management assertions or attestations.
Rank #4
- Next Generation Wireless Technology - Wireless AC750 for optimized performance and reliable coverage delivering smooth HD video streaming, fast file transfers and lag-free video chatting.
- Dual Band Performance - Up to 300Mbps (2.4GHz) + 433Mbps (5GHz) to deliver fast wireless speeds and less interference for maximum throughput
- Backward Compatibility - Compatible with a/b/g/n devices.
- Wired Connectivity - Four Fast Ethernet ports for fast device connectivity
- High-Performance Antennas: 3 high-performance antennas deliver maximum range around your home. Please refer the User Manual before use.
What devices the order covered
The order defined a covered device as an IP camera or router that D-Link Systems sold, directly or through authorized resellers, to U.S. consumers on or after January 5, 2017. Devices offered primarily to enterprise or other commercial customers could be excluded, including products identified in the order’s exhibit. The definition therefore did not automatically extend the mandate to every D-Link product, every hardware revision, or products sold worldwide.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Was there a fine or consumer compensation?
No monetary payment was required under the settlement described by D-Link. The remedy was prospective security compliance and oversight, not a refund, damages award, or device-replacement program. The order did require certain consumer communications, including firmware-update instructions for registered covered devices and notice before security updates ended when the order’s conditions applied. D-Link’s contemporaneous statement addressed the absence of a payment requirement and the lack of a liability finding.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Best Value
- Next Generation Wireless Technology Wireless AC1200 for optimized performance and reliable coverage delivering high quality HD video streaming, gaming and file transfers.
- Backward Compatibility Compatible with wireless 802.11a/g/n devices
- Connect more devices with four Gigabit Ethernet ports
- Stream and share files using the USB Share Port and free mobile app
- Easy Setup with intelligent browser wizard and Quick Router Setup Mobile app
How the IEC security-standard option worked
The order allowed D-Link to elect an assessment against IEC 62443-4-1:2018, “Security for industrial automation and control systems — Part 4-1: Secure product development lifecycle requirements,” or an authorized successor or comparable standard. If the required certification was obtained, D-Link could be treated as compliant with the comprehensive-program requirement for a defined period—generally two years or until the next specified assessment deadline, whichever came first. That route was not a finding that D-Link had already certified all covered products, and it did not protect a materially misleading or incomplete assessment submission.
What the settlement means for connected-device security
The FTC’s case connected security-oriented marketing to the practices behind a product: testing before release, a process for finding and fixing flaws, and support after sale. For manufacturers, those controls can add development time and cost. Automatic updates may close vulnerabilities quickly but can create compatibility or user-control concerns; independent assessments add accountability while requiring recurring compliance work. A recognized standard can structure development, but neither certification nor a documented program eliminates implementation mistakes or future vulnerabilities.
For consumers, the 2019 order is not a current security certification for any particular D-Link model. Whether a device still receives updates depends on the model, hardware revision, and its present support status. Owners should check the manufacturer’s current support and security-advisory information for their exact device rather than infer that it is secure—or unsupported—solely from the settlement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
