What’s New in Peplink Firmware 8.5.4

Router Firmware 8.5.4 went GA on February 16, 2026. It is a security-and-stability release — and for several model families it is the required stepping-stone to Firmware 8.6. If your fleet is on anything older, this page is the short version of why the upgrade matters. The official release notes are here (PDF).

The headline: a real security fix

• A vulnerability in the device API that could allow remote code execution is closed (reference 35920). If a device is reachable from networks you don’t control and runs pre-8.5.4 firmware, this fix alone justifies the maintenance window.
• The tunneling protocol behind Remote Web Admin and InTouch was updated for stronger security, and the Captive Portal SSL certificate was refreshed.

Quality-of-life improvements

• HA configuration sync every 2 minutes (was 5) — failover pairs drift less. Taught in High Availability.
• iPhone USB tethering: use an iPhone as a USB mobile modem on a wide range of Balance, MAX MBX, B One, MediaFast, and SDX models.
• Wi-Fi WAN roaming improved for DHCP connections — mobile deployments hop access points more cleanly.

Cellular & 5GK fixes

Two of these are specific to 5GK-chipset devices — the current cellular platform. If you run 5GK hardware on older firmware, these are your reliability fixes.

• Cellular service could stop unexpectedly on 5GK devices in 5G mode — fixed.
• 5GK SINR readings showed incorrectly when no data was flowing — fixed.
• Automatic carrier selection no longer re-applies itself repeatedly; cellular module firmware upgrades no longer fail mid-flight.

eSIM, RemoteSIM & SIM failover

• Peplink eSIMs are no longer skipped during SIM failover when the device can’t reach InControl.
• BYO eSIM details display correctly in Synergy mode; RemoteSIM traffic over Synergy establishes properly.
• WAN Restriction rule refresh is fast again when RemoteSIM servers use hostnames.

Synergy & Switch Controller

• Synergized devices come back online in InControl after a link drop + reboot; certificate updates no longer break Synergy connections.
• Configuring External Access on a VLAN no longer knocks SD Switches offline; managed-switch status and peer serial numbers report to InControl correctly.

Everything else worth knowing

• DNS: custom DNS servers now work in the HA slave role; DNS-over-HTTPS works with Quad9; grouped-network DNS handling fixed.
• Wi-Fi: clients can join SSIDs with IPv6 + per-port VLAN enabled; Wi-Fi WAN reconnects to WPA3 APs after a disconnect.
• System: outbound policy falls back correctly when an IPsec VPN drops; GPS forwarding handles more GNS formats; multicast relay uses the right source MAC; the Web UI no longer freezes when changing WAN bandwidth; USB WAN settings survive reboots; general stability fixes.

The last 8.5.x stop for these models

Peplink’s notice in this release: the following models will not receive major firmware beyond 8.5.x (maintenance releases continue):

• Balance: 30 LTE HW3, 30 Pro HW1, 210 HW4-5, 310 HW4, One HW1-3, One Core HW1
• MAX: 700 HW3-4, BR1 ENT HW1-2, HD1 Dome HW1, HD2 HW5-6, HD2 Dome, HD2 IP67 HW2-5, HD2 Mini HW1-4, HD2/HD4 with MediaFast HW1-4, HD4 HW1-5, HD4 IP67 HW1, Transit HW1-3, Transit 5G HW2-3, Transit Core HW1, Transit Duo HW1-3, Transit Duo Pro E HW1, Transit Pro E HW1
• MediaFast: 200 HW1/HW3  ·  SpeedFusion Engine: SFE CAM HW1

Running one of these? It still works — but it’s a planning signal. Find the current replacement or talk to an expert about upgrade paths (many chassis take a simple module swap to the 5GK cellular platform).

Known issues

• With multiple-IP passthrough WAN, LAN clients on ports 1–2 may fail to obtain an IP.
• Docker containers require an active DHCP server on the device.
• YouTube blocking may not catch QUIC traffic.
• Changing a switch port PVID may not apply properly (fixed in 8.6).