Peplink Patches Legacy Routers in Firmware 8.3.2, 8.5.5

On August 21, 2026, Peplink released two firmware builds on the same day. Neither one adds a feature. Neither one is a beta. Both exist for a single reason, which is to close security holes on hardware that most of the networking industry stopped thinking about years ago.

Firmware 8.3.2 covers devices like the Balance 20, Balance 30 LTE, MAX BR1 HW1, SOHO MK3 and UBR LTE. Some of that hardware has been in the field for more than a decade. Firmware 8.5.5 covers the middle generation, including the Balance One, Balance 30 Pro, MAX 700 HW3-4, HD4 and the Transit family.

If you own any of it, you should be reading the rest of this page. If you are evaluating who to buy your next router from, the fact that these two builds exist at all is worth more of your attention than any spec sheet.

What Hardware Each Release Covers

Firmware 8.3.2 supports Balance 20 HW7-8, 210 HW2-3, 30 LTE HW1-2, 310 HW2-3 and 50 HW1-3. On the Pepwave side it covers MAX 700 HW1-2, BR1 HW1, BR1 HW2-3, BR1 ESN, BR1 IP55, BR1 IP67, BR1 M2M, BR1 MK2, BR1 Mini, BR1 Mini Core, BR1 Pro HW2-6, BR1 Slim, BR2, BR2 IP55, HD2 HW1-4, HD2 IP67, Hotspot, On-The-Go HW2 and Transit Mini. It also covers SpeedFusion Engine HW1-2, Surf SOHO HW2, SOHO MK3 and UBR LTE.

Firmware 8.5.5 supports Balance 30 LTE, 30 Pro, 210 HW4-5, 310 HW4, One HW1-3 and One Core. On the Pepwave side it covers MAX 700 HW3-4, BR1 ENT, HD1 Dome, HD2 HW5-6, HD2 Dome, HD2 IP67 HW2-5, HD2 Mini, HD2 with MediaFast, HD4 HW1-5, HD4 IP67, HD4 with MediaFast, Transit, Transit 5G, Transit Core, Transit Duo, Transit Duo Pro E and Transit Pro E. It also covers MediaFast 200 and the SFE CAM.

These lists matter because they are the devices that cannot run current mainline firmware. A Balance 20 is never going to boot 8.6.x. That is exactly the population that normally gets abandoned.

A Note on Terminology: Legacy Versus End of Life

Throughout this article we call these devices legacy, not EOL. That is deliberate, and the distinction is not just semantics.

End of life is the standard vocabulary of the networking industry. Cisco built the framework that most vendors now copy, a formal sequence of published milestone dates: end of life announcement, end of sale, last ship date, end of software maintenance, end of new service attachment and finally last day of support. Once that clock starts, it runs to zero. After the end of software maintenance milestone, engineering stops developing, repairing and testing the product software. That is the point at which a discovered vulnerability simply stays open, permanently, with a migration guide offered instead of a patch.

Nearly every hardware manufacturer operates some version of that model. It is not necessarily malicious. Supporting an infinite back catalog is genuinely expensive, and a defined support window lets a vendor plan engineering capacity honestly. But the practical result for the buyer is the same: a date exists, often set years in advance, after which your working equipment stops receiving security fixes.

Peplink is the outlier in our lineup. The company does not publish EOL notices, does not maintain an EOL product listing, and does not schedule end of support dates. Its published position is that it does not discontinue or EOL a product at all, and that instead it extends the product lifecycle through new hardware revisions while continuing to deliver software updates covering both features and security issues. What Peplink calls legacy, most of the industry would have called end of life years ago.

One honest caveat. We have not audited every manufacturer on earth, and lifecycle policies change, so treat this as a characterization of common industry practice rather than an absolute claim about every vendor. Before you buy from anyone, including us, read that vendor’s own lifecycle page and check whether the support window is measured in years, in milestones, or not at all.

The Headline Fix: CVE-2026-42945, Known as NGINX Rift

Both releases patch this one, and it is the most urgent item in either set.

CVE-2026-42945 is a heap buffer overflow in the NGINX rewrite module, ngx_http_rewrite_module. It was introduced into the NGINX codebase in 2008 and sat undiscovered for roughly 18 years. It affects NGINX Open Source versions 0.6.27 through 1.30.0 and NGINX Plus vR32 through R36, along with F5 products that bundle the software. Public reporting has assigned it a CVSS v4 score of 9.2 and nicknamed it NGINX Rift.

The mechanics are worth understanding because they explain why this reaches a router at all. NGINX processes rewrite rules in two passes. It first calculates how much memory the result will need, then copies the data into that allocation. The escaping logic differs between those two passes, so bytes derived from an attacker controlled URI can be written past the end of the allocated heap buffer inside the worker process. The trigger is a specific but common configuration pattern: a rewrite directive using an unnamed capture such as $1 or $2, a replacement string containing a question mark, followed by another rewrite, if, or set directive in the same scope.

The result is a heap buffer overflow in the worker process reachable by an unauthenticated attacker sending crafted HTTP requests. Best case that is a denial of service. Worst case it is remote code execution, and public reporting indicates code execution is more achievable on systems where ASLR is disabled, which describes a great many embedded devices. This is not theoretical. VulnCheck reported active exploitation within about a week of disclosure.

Here is the part people miss. Your router’s web administration interface is a web server. It inherits the bugs of whatever web server it was built on. Peplink did not write this flaw. Peplink inherited it, the same way thousands of other vendors did. What separates vendors is not whether they ship upstream bugs, because everyone does. It is how fast they notice, and how far back down their product line they push the fix.

The 2023 Vulnerability Set Finally Reaches the 8.3 Branch

Firmware 8.3.2 also backports four vulnerabilities that the French security firm Synacktiv reported against the Balance Two. Their timeline is documented in the original advisory: reported to Peplink on June 1, 2023, confirmed and fixed by Peplink in version 8.4.0 on July 21, 2023, with 8.4.0 released October 5, 2023 and public disclosure on December 7, 2023. Versions 8.1.2 through 8.3.0 were confirmed affected, with earlier versions considered likely vulnerable as well.

Peplink handled that responsibly at the time. The catch is that the fix landed in 8.4.0, and devices that cannot run 8.4.0 stayed exposed. That gap is what 8.3.2 closes, nearly three years later.

CVE-2023-49226, command injection in the admin console. The traceroute feature in the administration console fails to validate input properly, letting a user with administrator privileges execute arbitrary commands as root on the underlying system. That sounds mild because it requires admin access, but it is not. It converts a web interface login into a full root shell on the device, which means every credential, certificate and VPN key the router stores becomes readable. It also turns a stolen or reused admin password into total device compromise rather than a configuration nuisance.

CVE-2023-49228, console port giving root access. This is the most uncomfortable of the four. The serial console port can be used to reach the administration console regardless of which features are enabled on the device, and a list of hardcoded usernames and passwords, hashed with SHA1 and indexed by device model, spawns a root shell even when the CLI SSH and Console option is disabled. Synacktiv was able to recover credentials from the hashes, publishing the Balance Two username as an example. Hardcoded credentials are classified as CWE-798, and they are a category of flaw that never degrades gracefully. Once the hash is cracked, it is cracked for every unit of that model, worldwide, forever. The only fix is removing the mechanism.

The practical exposure here is physical access, which lowers the risk for a router locked in a server room. It raises it considerably for the mobile and vehicle deployments that Pepwave hardware is built for. A MAX Transit in a bus, a BR1 in a utility truck or an HD2 in a remote cabinet is a very different threat model.

CVE-2023-49230, missing authorization on captive portals. Captive portal configurations could be modified without any prior authentication, by posting to the portal upload endpoint with the target portal ID. Synacktiv demonstrated injecting a script tag into a portal button, producing JavaScript execution in client browsers. An administrator still has to validate the pending changes before they deploy, which limits the immediate danger, but a careless administrator approving changes without reviewing them would push attacker supplied code to every guest connecting through that portal, enabling credential theft.

Guest Wi-Fi portals are trusted by users almost by reflex. Nobody inspects a captive portal page before typing their email into it. That is what makes stored cross site scripting in a portal more dangerous than the CVSS math suggests.

CVE-2023-49229, secrets accessible to read-only users. Accounts with read-only permissions could query the administration web service and retrieve the pre-shared keys for every PepVPN configured on the device. Read-only accounts exist so you can give a junior technician, a contractor or a monitoring platform visibility without handing over control. This vulnerability quietly voided that boundary. Anyone with view access held the keys to your site to site tunnels, and could stand up a rogue endpoint or decrypt captured traffic.

One accuracy note for anyone cross referencing. The 8.3.2 release notes attach CVE-2023-49230 to the read-only secrets issue and CVE-2023-49229 to the captive portal issue. The original Synacktiv advisory assigns them the other way around, with CVE-2023-49230 covering lack of authorization on portals and CVE-2023-49229 covering secrets accessible to read-only users. Both fixes are in the build either way, so nothing is missing, but the identifiers are transposed.

The Fixes That Did Not Get CVE Numbers

Both releases include security work that never received a public identifier, and this is normal rather than suspicious. Vendors routinely find and fix issues internally, and internally discovered bugs frequently ship without a CVE assignment.

In 8.3.2, reference 37202 addresses an API vulnerability that could allow remote code execution, and 37208 fixes an SSH CLI command injection flaw. In 8.5.5, reference 37227 fixes a web administration flaw allowing unauthenticated access to internal binaries, and 37226 fixes the equivalent SSH CLI command injection. Both builds also update SSH CLI components to address multiple security vulnerabilities, listed as 37317 and 37225 respectively.

Read those descriptions closely. Unauthenticated access to internal binaries and an API path to remote code execution are serious findings. They arrived with no CVE, no press coverage and no vendor marketing, in a release note for hardware nobody writes headlines about.

Why Backporting Like This Is Genuinely Unusual

Software maintenance costs money and generates no revenue. Every backport means keeping an old build environment alive, maintaining a source branch that diverged years ago, applying a patch written for newer code to an older architecture, and then regression testing it across dozens of hardware revisions with different chipsets and radios.

The commercial incentive runs the opposite direction. An unpatched router is an argument for buying a new router. Plenty of manufacturers have made exactly that calculation, declaring devices end of life on a published schedule and letting known vulnerabilities stand as a nudge toward the upgrade path. The FBI has issued public warnings about botnets specifically targeting end of life routers, because abandoned hardware with permanent unpatched flaws is precisely what attackers hunt for.

This is where the terminology difference stops being a word game. Under a conventional EOL program, the four 2023 vulnerabilities described above would have been the end of the story for anything that could not run 8.4.0. Those devices had passed their software maintenance milestone. The advisory would have been published, the fix would have shipped for current hardware only, and a Balance 20 owner would have been handed a migration path.

Instead, three years later, someone at Peplink revived an old build branch and backported the fix. Any vendor can write a no-EOL policy on a web page. Firmware 8.3.2, shipping in 2026 for hardware that predates the iPhone 6, is that sentence being honored in code.

Why This Should Shape Your Next Purchase

Router hardware is not a two year asset. A Balance or a MAX unit installed correctly will run for eight to twelve years. Over that horizon, the total cost of ownership is dominated not by purchase price but by whether the manufacturer keeps the firmware alive.

Ask three questions before you buy anything:

1. Does the vendor publish a firmware support window, and is it measured in years or in months?
2. Does the vendor publish security advisories, credit outside researchers, and assign CVEs, or does it fix things silently?
3. Can you find evidence of the vendor patching hardware it stopped selling? A published policy is a promise. A dated release note for a discontinued model is proof.

That third question is the one that separates marketing from engineering culture, and it is difficult to fake.

At 5Gstore we deliberately carry manufacturers with real support track records rather than the cheapest hardware we could source. You can browse current lineups from Peplink, Cradlepoint, Teltonika, Semtech, Inseego, Digi and Katalyst. Each of these vendors takes a different approach to lifecycle support, and we are happy to walk you through the differences before you commit to a platform.

How to Update

Download the correct build from the Peplink firmware downloads page and confirm your exact hardware revision first. The two releases cover different device generations, and picking the wrong branch will simply fail to install.

If your devices are enrolled in InControl 2, you can stage the upgrade centrally and schedule it for a maintenance window rather than touching each unit. For remote and mobile deployments, upgrade during a period when you can tolerate a reboot and, ideally, when someone can reach the device physically if something goes wrong.

Given that CVE-2026-42945 is unauthenticated, reachable over HTTP and already being exploited in the wild, treat this as a priority update rather than routine housekeeping. Until you can patch, make sure the web administration interface is not exposed to the WAN.

5Gstore Take

The interesting story here is not the patch. It is the population of devices that received it.

Somewhere in the world there are Balance 20 units that were installed before the iPhone 6 shipped and are still passing traffic. Firmware 8.3.2 exists for them. That is a deliberate choice by an engineering organization that could have saved the money and pointed those customers at a new SKU instead.

We would add one honest counterpoint. Backporting is not the same as being current, and this release should not be read as a reason to run decade old hardware indefinitely. An 8.3.x device is missing years of feature work, and older hardware has real limits in throughput, cellular band support and modem generation that no firmware update can fix. If your BR1 HW1 is patched but sitting on a 4G modem in an area where the carrier has already refarmed spectrum, the security fix solves one problem and leaves a performance problem untouched. The right reading is that Peplink buys you the ability to upgrade on your schedule rather than on an attacker’s.

If you are unsure which firmware branch your hardware belongs on, whether a legacy unit is still the right tool for the job, or how to plan a fleet wide upgrade without downtime, contact us. We have been supporting this hardware since 2005 and we will give you a straight answer, including when that answer is that your existing unit is fine as is.

Frequently Asked Questions

Which firmware do I need, 8.3.2 or 8.5.5?
It depends on your exact model and hardware revision, not just the model name. A MAX 700 HW1-2 takes 8.3.2 while a MAX 700 HW3-4 takes 8.5.5. Check the hardware revision on the device label or in the web interface before downloading.

Are these releases only security fixes?
Yes. Every item in both release notes is tagged as a security advisory. There are no new features or general bug fixes in either build.

Is CVE-2026-42945 actually being exploited?
Yes. Active exploitation was reported within roughly a week of the vulnerability being disclosed, and public proof of concept code exists. This is the item that should drive your patching timeline.

My router is not exposed to the internet. Do I still need to update?
Yes, though the urgency drops. CVE-2026-42945 requires reaching the web interface, so a router with no WAN side administration is much harder to hit remotely. But CVE-2023-49228 involves physical console access and CVE-2023-49229 involves an authenticated read-only account, and neither of those depends on internet exposure.

Why are 2023 CVEs being fixed in 2026?
They were fixed in firmware 8.4.0 back in October 2023. Devices too old to run 8.4.0 never received that fix. Release 8.3.2 backports it to the older branch so that legacy hardware finally gets the same protection.

Why do you call these legacy instead of end of life?
Because Peplink does not use the EOL designation. Most manufacturers publish formal end of life notices with dated milestones, including a specific date after which software maintenance stops. Peplink publishes no such notices and no end of support dates, describing older products as legacy and continuing to ship updates for them. The two words describe very different commitments.

Does Peplink really never EOL products?
That is Peplink’s stated policy, and the company describes extending lifecycles through hardware revisions rather than discontinuation, with continued software updates for features and security. In practice, older hardware stops receiving new features long before it stops receiving security patches, which is what this release demonstrates. Legacy does not mean identical to current, but it does mean still defended.

Will updating reset my configuration?
Firmware updates preserve configuration in normal circumstances, but export a backup before you start. It costs a minute and it has saved plenty of people a long evening.