Connectivity Intel: FCC Tightens the Router Rules

Last week was a regulatory week. The FCC took two more steps toward turning its March router ruling into something with teeth, Starlink became the first company to file a new Wi-Fi 7 router under the exemption process, and a mid-month CVE check shows a few brands worth watching. Here is what mattered.

The FCC Starts Closing the Import Door

On August 10 the FCC issued a Public Notice proposing to prohibit the continued importation and marketing of equipment on its Covered List, and on August 14 it announced another round of conditional approvals for certain routers. Taken together, these are the enforcement half of the March 23 ruling that added “routers produced in a foreign country” to the Covered List.

The distinction that matters for procurement has not changed. The March action blocks new equipment authorizations for consumer grade residential routers as defined by NIST IR 8425A. Devices that already hold an FCC authorization can still be imported, sold, and supported. What the August 10 notice signals is that the FCC is now asking whether previously authorized covered equipment should keep its import and marketing privileges. That is a narrower question than it sounds, because the current proposal targets equipment added to the Covered List in 2024 or earlier, but it establishes the mechanism.

If you buy enterprise cellular gear, the near term impact is still limited. The business, fleet, and industrial platforms from Peplink, Cradlepoint, Digi, Teltonika, Semtech and Sierra Wireless, Inseego, and Katalyst are not consumer residential routers, and existing authorizations continue as normal. The medium term question is which vendors secure conditional approvals and which do not, because approvals require a time bound plan to move manufacturing to the United States and they run for limited terms. That is a roadmap question worth asking your vendors now rather than in 2027.

Starlink Files First, TP-Link Still Waiting

On August 13, SpaceX filed its UTR-261 Wi-Fi 7 router for FCC certification. It is the first new Starlink router to go through the process under the conditional approval SpaceX received, and it is a useful demonstration that the exemption path actually works end to end.

The contrast is the story. TP-Link moved its headquarters to the United States and still does not have a conditional approval, while Netgear, Amazon’s eero, Askey, Sercomm, and Vantiva have all secured one, generally running into early 2028. For anyone maintaining a hardware standard across sites, the approval list is quietly becoming a more useful procurement filter than the spec sheet.

Starlink Aviation Pricing Doubles

Starlink’s aviation price increase took effect August 7. Global Unlimited moved from $10,000 to $20,000 per month, with a new Regional tier at $12,500 for narrower coverage. This follows the June 18 consumer increases that added $5 to $10 per month across Residential and Roam, and the Mobile Regional plan rebrand to Roam Unlimited at $165.

For customers bonding Starlink with cellular, the pricing trend strengthens the case for treating satellite as one WAN among several rather than the primary link. Constellation capacity keeps improving, with V3 satellites delivering over 1 Tbps of downlink each and gigabit service rolling out to enterprise and Performance tiers first, but per site cost is climbing at the same time.

Firmware and Security Watch

Our RouterCVE report card snapshot from Monday morning shows a mostly healthy picture across the brands we carry, with two items worth a look.

Teltonika holds an A but its trend arrow moved to Getting Worse, with 2 new CVEs in the last 30 days and 3 over 12 months. That is still a strong absolute position. It is the direction, not the magnitude, that is worth tracking, and it is a good reminder to keep RutOS current and to check the Teltonika Security Centre when you are planning maintenance windows.

Semtech and Sierra Wireless picked up 1 CVE in the last 30 days and sits at A+. Separately, if you still run AirLink ES450 or other end of life ALEOS hardware, CVE-2018-4063 is in the CISA Known Exploited Vulnerabilities catalog with confirmed exploitation, and CISA’s guidance was to move to a supported platform or stop using the affected units. That is the one item on this list we would treat as urgent rather than routine.

Starlink also shows 1 CVE in 30 days at A+. Peplink is at A+ and Stable with zero in 30 days, Cradlepoint and Inseego are at A+ with zero across all windows, and Digi is A+ with a Getting Better trend.

For contrast, the migration source brands most customers are leaving continue to look rough. GL.iNet logged 21 CVEs in 30 days, Cisco 25, Palo Alto Networks 12, Netgear 9, Zyxel 8, Fortinet 7, and TP-Link 7. If you are still running a consumer or prosumer platform in a role that matters, those numbers are the argument.

If you run Peplink and have not moved to Firmware 8.6.0 yet, it carries fixes for a CLI command injection issue, an unauthenticated Web Admin access issue, and CVE-2026-42945. Note the staged upgrade path on BR1 Pro, BR2 Pro, Dome, Transit, and B One models, which must be on 8.5.4 first, and audit your certificates and FIPS preshared keys before you schedule the window.

Spectrum and Industry

Carrier reliability. The August 8 multi carrier disruption produced more than 13,000 peak Verizon reports, with AT&T and T-Mobile customers also affected, concentrated in New York, Los Angeles, and Boston. Follow on reports surfaced again on August 17, though nothing confirmed a single shared root cause. Two notable events in three weeks is exactly the pattern that sells failover, and it is worth pointing at when a customer asks whether single carrier is good enough.

Spectrum. AT&T is pursuing more 3.45 GHz through a licensing arrangement with Blue Ridge Wireless, and the FCC has been reminding 3.45 GHz licensees about 2026 buildout obligations. UScellular is selling roughly 55% of its remaining spectrum in about $1 billion tranches to each of AT&T and Verizon.

Hardware market. Digi and Netgear both signaled the same read on demand in recent commentary, that enterprise and industrial connectivity is where the growth is while consumer and single purpose hardware is under pressure. Digi also nominated two new board members, including Cradlepoint’s former CFO. Inseego shipped an unlocked MiFi PRO M4 supporting all three major US carriers on August 5, which is a genuinely useful SKU for anyone who does not want carrier locked spares in the truck.

5Gstore Take

Three practical takeaways from last week.

First, the FCC’s router actions are still not a crisis for enterprise cellular, but the conditional approval list is turning into real procurement intelligence. If you are standardizing on a platform for the next three to five years, ask where it is built and whether the vendor has filed. We are tracking this across every line we carry and are happy to tell you what we know.

Second, patch the Sierra Wireless end of life hardware. An actively exploited flaw on gear that no longer receives fixes is not a maintenance item, it is an exposure. If you need a migration path off ES450 class hardware, that is a conversation worth having this month.

Third, the August outages and the Starlink price increases push in the same direction. Multi WAN with real bonding and failover, sized so that no single carrier or satellite plan is load bearing, is the architecture that survives both a bad Saturday afternoon and a bad renewal quote.

If you want help reading any of this against your own deployment, whether that is upgrade sequencing, a replacement path off end of life hardware, or picking the right mix of cellular and satellite, contact us. We work with this gear every day.