Peplink Firmware 8.6.1 Is Out: What’s New and Fixed

Peplink released Router Firmware 8.6.1 as a general availability build on September 30, 2026. It is now the standard firmware listed on the Peplink firmware downloads page for most current Balance, MAX, Dome, Transit, Orbit, B One, SDX, MBX, PDX, EPX, UBR and FusionHub hardware.

This is a point release, and the notes read like one. By our count there is 1 new feature, 17 improvements and 41 resolved issues. Peplink moved fast: Beta 1 appeared on September 11, RC1 followed on September 16, and GA landed 14 days after that. We covered both earlier builds in our 8.6.1 Beta 1 breakdown and our 8.6.1 RC1 post. This post covers the final release, what each change actually means in the field, and who should upgrade first.

The Short Version

Four themes run through 8.6.1:

• Security hardening. Three security advisories, plus three more changes that tighten firmware uploads, API requests and Device API input validation.
• Fewer paywalls. Synergy Mode, Starlink Dish API access and Secure DNS all lose some or all of their Care plan requirements.
• Starlink and cellular polish. A Starlink event log, Starlink RF inhibit, better Starlink GPS reporting, and IPv6 on more cellular modems.
• A big cleanup of 8.6.0 special builds. 22 of the entries carry a “Fixed in 8.6.0sXXX” tag, meaning Peplink support had already shipped those fixes as one-off builds. 8.6.1 folds them back into the main line.

Supported Devices

8.6.1 supports the following hardware:

• Balance: 20X HW1 to HW3, Two HW1, 310 HW5, 310 5G, 310 Fiber 5G HW1, 310X HW1 to HW4, 380X HW1, 580X, 305 HW2, 380 HW6, 580 HW2 and HW3, 710 HW3, 1350 HW2, 2500 HW1, 1350 EC HW1, 2500 EC HW1, 5000 EC
• SDX: SDX HW1 to HW4, SDX Pro HW1 and HW2
• Dome: HD1 Dome Pro HW1, Pro Duo HW1, Pro LR HW1
• MBX: MBX, MBX Mini HW1
• BR: BR1 Mini HW3, BR1 Mini Core HW3, BR1 Mini 5G, BR1 Mini M2M HW1, BR1 IP55 HW4, BR1 Pro (CAT-20) HW7, BR1 Pro 5G HW1 to HW3, BR2 Pro HW4, BR2 HW4, BR2 Micro HW1
• Transit: Pro E HW2, Duo Pro HW1
• Orbit: MAX Orbit 2, MAX Orbit 4 and MAX Orbit 8 (HW1)
• B One: B One HW1, B One Plus HW1 and HW2, B One 5G HW1 and HW2
• MediaFast: 500 HW1 and HW2, 750 HW1
• UBR: UBR Plus HW1
• Other: EPX HW1, PDX HW1 and HW2, FusionHub HW1 and HW2

Peplink publishes 8.6.1 as five separate firmware images grouped by hardware platform, so download the file linked next to your exact model and hardware revision rather than reusing a file from another router.

New Feature: Starlink Event Log (37458)

There is exactly one item in the New Features table. Peplink added an Orbit WAN tab under Status > Event Log that displays Starlink event logs directly on the router. If you run a Starlink dish behind a Peplink, you no longer need to open the Starlink app to see what the terminal has been doing. Dish events now live in the same Event Log as the router’s own WAN events, which makes it much easier to line up “the connection dropped at 2:14” with “the dish reported an obstruction at 2:14.”

This applies to every supported model except FusionHub, which makes sense since FusionHub is a virtual appliance with no physical WAN to attach a dish to.

Starlink Improvements

Starlink got more attention than any other area in this release. Beyond the new event log tab:

• Starlink Inhibit RF control (37401). The router can now tell a Starlink terminal to stop transmitting. This matters for aviation, maritime and public safety deployments where RF emissions must be shut off in certain locations or situations, and for anyone who wants to silence the dish without pulling power.
• Better Starlink GPS status reporting (37184). The router now identifies when GPS data is unavailable because of a subscription restriction rather than a hardware or signal problem. That distinction saves a lot of troubleshooting time.
• Smarter dashboard GPS warning (37185). The “Starlink GPS unavailable” message now appears only when Starlink GPS is enabled and no Starlink WAN is providing location. Fewer false alarms.
• No Care plan needed for Dish API LAN access (37094). Peplink removed the Care plan requirement for LAN access to the Starlink Dish API. Tools and dashboards on your LAN that poll the dish directly can now reach it without an active subscription on the router.

Not sure Starlink covers your area? Check Your Coverage Area before you plan a deployment around it.

Synergy Mode Goes License Free

Synergy Mode lets a primary Peplink router (the Synergy Controller) absorb the WAN connections of a second Peplink (the Synergized Device), so you can add cellular or Starlink capacity without replacing hardware. 8.6.1 makes three meaningful changes:

• Care plan and license requirements removed (37239). Neither the Synergy Controller nor the synergized devices need a Care plan or license anymore. This is the single biggest value change in the release. An older Peplink that would otherwise sit in a drawer can now be repurposed as extra WAN capacity at no ongoing cost.
• USB Ethernet WAN support (37704). Synergized Devices can now connect over a USB Ethernet WAN adapter, which helps on compact routers that are short on physical Ethernet ports.
• Three Synergy fixes. The Synergy Controller now correctly follows its configured enable setting (37881, added in RC2). Wi-Fi clients no longer fail to get an IP address when one controller manages several Synergized Devices (37839, added in RC1). And BR1 Mini devices can now form Synergy Mode even when the controller still has its default admin credentials and LAN IP (37604).

Cellular and IPv6

• IPv6 on more cellular devices (36889). IPv6 support now covers cellular modules whose product code contains LTEA-US, LTEA-K, LTE-E, LTEA-D, GLTE-G, LTEA-Q, LTEA-E, LTEA-R, LTE-EJ, LTE-MX, LTE-MXS or LTE-US, on supported Balance, BR, Transit, B One, EPX, PDX, SDX, Dome and MBX models. Check the product code on your modem before assuming you have it.
• IPv6 Router Advertisements follow the ISP (37760). LAN RA intervals and lifetimes now track the lifetimes your ISP provides, which reduces stale IPv6 addresses on LAN clients after a prefix change.

On the fix side, cellular got a long list of carrier-specific repairs:

• Slow registration on Vodafone in Italy (37264)
• 5GD modules failing to switch carrier profiles (37196)
• IMS staying enabled on 5GK modules connected to a private network (37521)
• Modem firmware upgrades failing on LTE-E, LTE-US, LTE-MX and LTE-MXS modules on RAMIPS models running 8.6.0 (37183). If you could not update modem firmware after moving to 8.6.0, this is why.
• LTEA-K modules failing to get an IPv4 address on Optus (37792)
• LTEA-Q modules unable to establish data on KDDI in Japan (37186)

Security Fixes

Six items in 8.6.1 are security related, and all six apply broadly:

• Web Admin access control vulnerability (36956). Security Advisory, all models.
• Management CLI vulnerabilities (37657). Security Advisory, all models.
• DHCP client hostname handling vulnerability (37662). Security Advisory, all models.
• Hardening against remote code execution through API requests (37690). All models.
• Stronger authentication and request validation for firmware uploads (37827). Added in RC1, all models. Whoever can push firmware to a router owns that router, so this one matters.
• Input validation fix in Device API configuration handling (37611). Nearly every supported model, including FusionHub.

Peplink’s release notes describe these at a high level and do not list CVE identifiers. If you have routers with Web Admin or the API reachable from the internet, treat 8.6.1 as a priority upgrade regardless of the other changes.

Other Improvements Worth Knowing

• Secure DNS with any Care plan (37249). Peplink’s DNS filtering feature previously required PrimeCare. It now works with any active Care plan.
• Docker shared memory limit (37098). Docker containers on supported models now share a single memory limit instead of individual allocations. If you run several containers, check their behavior after upgrading.
• GPIO output inversion (37260). A new option inverts GPIO digital output in WAN Status mode, handy for wiring status lights or relays that expect the opposite logic.
• WINS server support returns (37393) on selected Balance, BR, Dome, Transit, Orbit and B One models.
• InControl feature activation (37535). InControl can now apply feature activation keys even when a device is set to Restricted to Status Reporting Only.
• DNS-O-Matic removed from Dynamic DNS (37764). Peplink says the service is being discontinued. If you use it, move to your DDNS provider directly or to Find My Peplink before upgrading.
• New WAN health check targets (37381). WAN health checks now use Google, Cloudflare and Quad9 public DNS as targets.

Resolved Issues Highlights

Beyond the cellular, Synergy and security fixes above, the most operationally important repairs are:

• SpeedFusion: Connect tunnels dropping large packets (37406), SpeedFusion Boost dropping traffic to ports 80, 2222, 5000 and 44444 or from FusionHub LAN clients (37703), dropped IP-fragmented UDP on the receiving side (37705), traffic loss after a peer restarted a flow’s packet sequence (37628), and SpeedFusion Score per-WAN tests failing with a standby WAN in the tunnel (37557).
• Stability: a reboot during QoS initialization (37505), excessive memory use from repeated SNMP GPS queries (37627), repeated InControl disconnections under heavy client recognition traffic (37214), and B One and B One Plus crashes after a USB reset (35984).
• High availability: both Balance 1350 EC units could become HA master after a reboot with LACP on SFP ports (37788).
• LAN and VLAN: Balance 310 5G HW3 dropping untagged LAN traffic after reboot with VLAN access ports (37299), Balance 310 HW5 dropping tagged VLAN multicast with all ports on Trunk Any (37259), Bonjour forwarding advertising client services back to the service network (37668), UDP and Bonjour forwarding failing between VLANs with similar IDs (37746), and DHCP conflict detection logging a blank MAC (37439).
• GPS: malformed TAIP LN sentences in GPS forwarding (37436) and InControl reporting no GPS fix when location came from a cellular module (37160). Fleet operators feeding TAIP data to tracking platforms should take note.
• Wi-Fi: a Wi-Fi 6 stability issue when clients roam between SSIDs on the same radio (37426), air-monitor settings disappearing after the 8.6.0 upgrade (37718), and Wi-Fi WAN failing to roam back to a Fast Transition enabled access point (37663).
• Ethernet: RAMIPS models failing to link at 100 Mbps with Energy Efficient Ethernet enabled (37500).
• FusionHub: FIPS could not be enabled (37586), and InControl Remote Web Admin could fail with FIPS on and Remote Assistance off (37674).
• Smaller fixes: CLI SSH failing to start after being enabled (37465), wrong PoE port numbers in InControl 2 (37263), a WAN port shown as LAN on the MAX Transit Duo Pro (37588), clipped text on the Balance 580X front panel display (37514), and Docker storage not clearing on factory restore (37728).

The Counterpoint: Reasons to Pause

8.6.1 is a solid maintenance release, but it is not a reason to push firmware to an entire fleet the afternoon it ships. A few honest caveats:

• Not every Peplink gets 8.6.1. Peplink’s downloads page still lists 8.5.5 as the current firmware for hardware such as the Balance One, Balance 310 HW4, MAX Transit, MAX Transit Duo, MAX HD2, MAX HD4 and the original MAX Transit Pro E HW1. Owners of those units do not get any of these fixes, including the security advisories.
• The beta cycle was short. Nineteen days from Beta 1 to GA is quick. During Beta 1, forum users reported an “Invalid Storage” error on install and a Starlink V1 terminal that would only negotiate 100 Mbps instead of 1 Gbps. The GA notes do not call out either report specifically, so if either applies to you, test before you roll out.
• Some changes alter behavior, not just bugs. Docker memory is now pooled. Factory restore now wipes Docker storage, so back up container data first. DNS-O-Matic is gone. WAN health checks now probe Google, Cloudflare and Quad9, so a firewall upstream that blocks those resolvers could cause false WAN down events.
• Security detail is thin. Peplink has not published CVE numbers or severity scores for the three advisories. That makes it harder for compliance teams to prioritize, even though the safe answer is still to patch.
• If support already gave you an s-build, check first. 22 entries were previously shipped as 8.6.0 special builds. If you are running one, 8.6.1 is your path back to standard firmware, but confirm that your specific fix is on the list.

How to Upgrade Safely

1. Download the image for your exact model and hardware revision from the Peplink firmware downloads page, or review the official 8.6.1 release notes (PDF).
2. Back up your configuration under System > Configuration before you start.
3. Upgrade one non-critical unit first and let it run for a few days under normal traffic.
4. For fleets, use InControl 2 firmware groups to stage the rollout.
5. Peplink routers keep two firmware images, so you can boot back into the previous version if something goes wrong.

5Gstore Take

8.6.1 is the release 8.6.0 should have grown into. The security fixes alone justify the upgrade for any router with remote management exposed, and the removal of Care plan requirements from Synergy Mode and the Starlink Dish API gives existing Peplink owners real new value without a new purchase. Starlink users get the most new capability, cellular users get the longest list of carrier fixes, and anyone who was handed an 8.6.0 special build finally has a clean path back to standard firmware.

Our advice is simple: upgrade internet-facing routers soon, stage everything else, and test any setup that depends on Docker, DNS-O-Matic or a strict upstream firewall first. If you want help planning a rollout, choosing hardware that will keep receiving updates, or deciding whether Synergy Mode makes sense for your spare routers, contact the 5Gstore team.

Frequently Asked Questions

Is Peplink firmware 8.6.1 a final release?
Yes. 8.6.1 is the general availability build released September 30, 2026, following Beta 1 and two release candidates.

Does 8.6.1 fix security vulnerabilities?
Yes. It includes three Peplink Security Advisories (Web Admin access control, management CLI and DHCP client hostname handling) plus three additional hardening changes covering API requests, firmware uploads and Device API input validation.

Do I still need a Care plan for Synergy Mode?
No. 8.6.1 removes the Care plan and license requirements for both Synergy Controllers and synergized devices.

Does 8.6.1 add IPv6 on cellular for every Peplink router?
No. It covers specific modem product codes on specific models. Check your device’s product code against the list in the release notes.

My router is not on the supported list. Will it get 8.6.1?
Peplink lists 8.5.5 as the current firmware for several older models, including the Balance One, MAX Transit, MAX HD2 and MAX HD4. Check the Peplink downloads page for your exact hardware revision.

Can I roll back if 8.6.1 causes a problem?
Yes. Peplink routers store two firmware images, so you can reboot into the previous version. Always back up your configuration before upgrading.

5Gstore carries cellular and multi-WAN hardware from Peplink, Cradlepoint, Teltonika, Semtech, Inseego, Digi and Katalyst.