Connectivity Intel: Starlink Roam Ends, GL.iNet Slips

Welcome back to our weekly look at what the cellular and satellite networking world was talking about. This week brought a hard deadline for Starlink travelers, continued movement on the FCC equipment rules, and a security scorecard that got noticeably uglier at the low end.

Starlink Global Roam Went Dark on August 17

The biggest operational story of the week. Starlink discontinued Global Roam for existing subscribers on August 17, closing out a plan that had already stopped accepting new customers on July 15. Global Roam was never advertised publicly. It was an upsell offered to customers who already had an active plan, and at roughly $400 per month it delivered unlimited land based service across supported countries. For full time international travelers it was the only realistic option.

Starlink is steering affected users toward Global Priority. At the same time, Roam Unlimited was restricted to 30 days of service outside the registered home country at a stretch, which is a meaningful change for anyone who assumed “unlimited” meant unlimited geography as well as unlimited data.

If you have customers running long duration international deployments, maritime installs, or overland expedition rigs, this one needs a phone call this week, not next month. Anyone who did not migrate before the 17th is already offline on that plan.

Full details are on the Starlink support site.

The FCC Keeps Turning the Screws on Router Imports

We covered the Covered List expansion in depth last week, and the follow through continued. On August 10 the Commission issued a public notice proposing to prohibit the import and marketing of additional covered list equipment, and on August 14 it issued a notice granting conditional approval for certain routers. Both fit the pattern established when foreign produced consumer grade routers were swept onto the Covered List back on March 23.

Two points worth repeating to customers, because the confusion is persistent:

1. Being added to the Covered List does not retroactively ban devices the FCC already authorized. Gear you already bought and deployed is not illegal to keep using.
2. It does block new authorizations, which means future model availability and replacement stock are the real risk, not your installed base.

The practical consequence for anyone specifying hardware right now is supply chain predictability. Vendors with US or allied manufacturing and a clean authorization path are simply lower risk to design into a multi year rollout. That is a large part of why we keep pointing integrators toward Cradlepoint, Digi, and Inseego for projects that need to survive a procurement review.

You can follow the notices directly at the FCC public notice archive.

Firmware and Security Watch

This week’s RouterCVE Report Card snapshot tells a clear story: the industrial and cellular router vendors are holding up well, and the budget consumer segment is falling apart.

GL.iNet is the standout problem. It logged 21 new CVEs in the last 30 days and sits at F minus with a Getting Worse trend, up to 96 total. The recent disclosures include information disclosure through the NAS service, authentication bypass after factory reset on the GL-RM series, and multiple command injection flaws in the AR300M and MT3000 lines. If you have GL.iNet units in the field, get administrative interfaces off the public internet, disable NAS features you are not using, and put management behind a VPN.

That matters for one more reason. Katalyst is a joint venture between Connected Solutions Group and GL.iNet, and it currently carries an NR grade with just one CVE on record. Too New to Rate is not the same as clean, so it is worth watching how the parent company’s disclosure hygiene carries over.

Elsewhere in the 30 day column:

• Peplink remains A plus with zero new CVEs in 30 days and only one in the past year. Firmware 8.6.0 went GA in late July and folded in fixes for a CLI command injection issue, an unauthenticated web admin access issue, and CVE-2026-42945. If you are still on 8.5.x, note the staged upgrade requirement: BR1 Pro CAT-20, BR1 Pro 5G, BR2 Pro, and all Dome, Transit, and B One models must land on 8.5.4 before moving to 8.6.0.
• Cradlepoint is the cleanest sheet in the set. A plus, zero in 30 days, zero in 12 months, two total.
• Teltonika picked up 2 CVEs in 30 days and holds an A, but the trend arrow flipped to Getting Worse. Recent RutOS builds patch CVE-2026-16455 and CVE-2026-18368, both rated medium. Worth scheduling, not worth panicking over.
• Semtech and Sierra Wireless took 2 in 30 days and stay at an A. The bigger risk here is legacy hardware. CVE-2018-4063 affecting older ALEOS platforms including the AirLink ES450 is in the CISA Known Exploited Vulnerabilities catalog with confirmed active exploitation. If you are still running end of life ALEOS gear, that is a migration conversation, not a patch conversation.
• Digi sits at A plus with zero in 30 days and a Getting Better trend, down to 2 in the past year from 9 across 24 months.
• Inseego remains at a perfect zero. No CVEs in 30 days, 12 months, 24 months, or all time.

On the consumer and enterprise side of the ledger, Cisco added 44 CVEs in 30 days, TRENDnet 18, Palo Alto Networks 12, TP-Link 10, Netgear 9, and Fortinet and Zyxel 7 apiece. TP-Link and TRENDnet both carry F minus grades with Getting Worse trends.

Spectrum and Industry

Carrier reliability had a rough couple of weeks. A multi carrier disruption on August 8 hit Verizon hardest with more than 13,000 peak reports, and AT&T and T-Mobile saw knock on effects, concentrated in New York, Los Angeles, and Boston. Users reported further scattered issues around August 17 without a confirmed single root cause. It is the recurring argument for failover: single carrier dependency is a single point of failure, and a bonded or multi WAN design turns a national outage headline into a blip your users never notice.

On the industry side, consolidation continued. Charlie Ergen’s SPAC acquired MobileX on August 18, and Lynk and Omnispace merged to form direct to device challenger Elveo Mobile. Amazon also filed plans to deploy up to 5,105 satellites for its Leo direct to device service using Globalstar spectrum. Meanwhile analysts note the big three carriers now have spectrum capacity to serve roughly 32 million fixed wireless subscribers, even as FWA net additions are expected to taper through 2026.

Digi reported Q3 2026 results on August 5, and its Remote Reach peer to peer edge access feature, launched in June, is now included at no extra charge with Digi Remote Manager subscriptions on 2026 and newer cellular hardware.

5Gstore Take

Three things we would act on this week.

If you touch Starlink, audit your plan assignments today. The Global Roam shutdown and the new 30 day international cap on Roam Unlimited are not theoretical. They are live. For customers bonding Starlink with cellular through a Peplink SpeedFusion setup, the satellite side is now the fragile leg of the design, and the cellular side is what keeps them online while they sort out a plan change. That is exactly the scenario multi WAN was built for.

If you have GL.iNet or other budget gear in production, treat this as a hardening week. Twenty one CVEs in thirty days is not noise. Lock down management interfaces and plan replacements for anything internet facing.

If you are specifying hardware for a 2027 deployment, factor the FCC rules in now. Authorization risk is a real procurement variable, and the vendors we carry with clean grades and stable supply chains are the safer bet.

Not sure where your fleet stands? Send us your model list and we will tell you what needs firmware, what needs replacing, and what is fine to leave alone. Contact the 5Gstore team and we will work through it with you.

One housekeeping note. Reddit blocks our research crawler, so social chatter from r/Starlink, r/Peplink, r/tmobileisp, and the rest is not reflected in this week’s roundup. If you saw something notable there, tell us and we will chase it down for next Monday.

FAQ

My Starlink Global Roam plan stopped working. What now?
The plan was discontinued for existing customers on August 17, 2026. You will need to select a replacement plan in your Starlink account. Starlink recommends Global Priority for continued extended international travel.

Does the FCC Covered List mean my current router is now illegal?
No. Adding equipment to the Covered List blocks new FCC authorizations. It does not retroactively ban devices already authorized, and it does not restrict continued use of hardware you already own.

I have GL.iNet routers deployed. What should I do first?
Remove administrative interfaces from public internet exposure, disable the NAS feature if you are not using it, and place device management behind a VPN or separate management network. Then plan firmware updates or replacement for anything internet facing.

Do I need to upgrade to Peplink firmware 8.6.0 right away?
It includes real security fixes, so it is worth scheduling. Check the staged upgrade path first. BR1 Pro CAT-20, BR1 Pro 5G, BR2 Pro, and all Dome, Transit, and B One models must be on 8.5.4 before moving to 8.6.0.

How can I tell whether my specific devices are affected by anything here?
Send your model list to our team and we will map it against current advisories and end of life status.