Update: newer TP-Link routers share DNS requests without permission

Newer TP-Link router models share data with security company Avira without permission.

According to a Reddit poster and tech website XDA, TP-Link’s standalone and mesh routers secretly share data about many DNS requests with security company Avira. Sharing is enabled by default.

Avira provides a cloud-based security service for the TP-Link routers: HomeShield Security. Although TP-Link gave the impression that end users can disable the service, data reportedly remains to be shared after opting out of the feature.

According to the whistleblowers, a great deal of data is being sent to *.safethings.avira.com. The number of DNS requests ranges from 42,000 to 80,000 per day.

Update: We reached out to TP-Link for a response. A spokesperson confirmed that some models automatically send requests to Avira subdomains, a German antivirus software company. These models include HomeShield, a security feature supported by Avira.

“Contact with this server is required to enable the security feature”, TP-Link said. “After reviewing the software, we identified errors in the DNS request logic. This resulted in frequent requests. In addition, when the HomeShield package was disabled, it was found that frequent contact was still being made.”

“All contact with this server is anonymous. It never contains personal information. We have optimized the software to prevent frequent inquiries. These improvements become active after installing the new firmware. We will publish new firmware for models daily.”

The firmware is available for most models. Below, you’ll find a list of all affected products, relevant firmware and release dates. TP-Link promises that an update will be available for every model starting March 28.

Tip: Research finds vulnerabilities in nine popular Wi-Fi routers