FCC Delays Security Update Ban for Foreign Routers and Drones to 2029

The Federal Communications Commission (FCC) has pushed back the deadline for banning security updates on certain foreign-made routers and drones. Originally set for March 1, 2027, the prohibition on these updates will now take effect no earlier than January 1, 2029. This delay, announced by the FCC’s Office of Engineering and Technology (OET), provides a longer window for organizations and consumers to adapt.

This decision impacts devices from vendors deemed a national security risk, primarily those with ties to adversarial nations. While the intent is to mitigate supply chain risks and prevent potential backdoors, extending the deadline means these devices will continue to receive patches for an additional two years. The Record by Recorded Future highlighted this shift, noting the original deadline would have meant a hard cutoff for security support.

For defenders, this is a double-edged sword. It grants more time to plan replacements and transition away from affected hardware, reducing immediate operational disruption. However, it also means a prolonged reliance on devices from vendors already flagged as high-risk, potentially extending exposure to state-sponsored compromise if vulnerabilities are exploited before the ban takes full effect. CISOs need to factor this extended timeline into their hardware refresh cycles and risk assessments.