Brand profile · models not graded yet
Is Peplink Safe?
Peplink is a Hong Kong-listed SD-WAN and cellular router maker using contract manufacturers. Ownership, CVEs and FCC status explained.
Ownership & FCC Status
Owner
Plover Bay Technologies (HKEX: 1523; controlled by founder and CEO)
FCC Status
Not on the Covered List; existing authorized models can still be sold; status of smaller retail models not determined
Ban Status
Not banned. Not named on the FCC Covered List
Manufacturing
Taiwan (contract manufacturer, per CEO)
Models graded
Not yet
Security Verdict
Peplink (Pepwave) is a Hong Kong-headquartered maker of SD-WAN and cellular routers, owned by Plover Bay Technologies, which is listed in Hong Kong and controlled by its founder. Its hardware is built by contract manufacturers, which the CEO says are in Taiwan. Peplink has had several high and critical-rated flaws since 2023, none on CISA's exploited list, and it posts advisories on its forum. It says its enterprise lineup falls outside the 2026 FCC consumer-router rule.
Bottom line: Peplink has no actively exploited flaws on record and a stated fix process. Keep firmware current, and check whether older models still get new releases.
From the team behind this checker
Weighing up Peplink? See the router that scores an A on this same method.
- SecureRooms. Smart devices live apart from your computers.
- You approve every new device before it joins.
- Rio VPN built in. First year included.
- Set up in about 10 minutes from the app.
$199.99 · 1 year of VPN included, then $7.99/mo · 30-day returns · 1-year warranty. Rio builds this site, and its router is graded by the same method as every other.
Corporate Ownership Structure
Peplink International Ltd and Pepwave are subsidiaries of Plover Bay Technologies Limited, a Cayman Islands company listed on the Hong Kong Stock Exchange (1523) and headquartered in Kowloon, Hong Kong. Founder and CEO Chan Wing Hong Alex is the beneficial controlling shareholder. The group owns no factories and uses contract manufacturers.
Key Risk Factors
High-severity flaws in several product lines
Since 2023, flaws include CVE-2023-49230 (CVSS 8.8, Balance Two), several Surf SOHO command injection issues found by Cisco Talos, and CVE-2026-57920 (CVSS 7.7) in the InControl 2 cloud service, fixed June 3, 2026.
No published end-of-life policy
Peplink has no official end-of-life policy. A community member said in 2023 that Peplink does not formally end-of-life products, but older hardware is eventually dropped.
Stated vulnerability response process
Pepwave's security vulnerability policy says reports are acknowledged within 24 hours, fixes ship in the next regular firmware, and zero-days get special releases.
No flaws on CISA's exploited list
No Peplink or Pepwave vulnerability is in the CISA Known Exploited Vulnerabilities catalog as of October 2026, and no botnet or state-actor reports were found.
Known CVEs - Peplink Routers
The following vulnerabilities from the NIST National Vulnerability Database affect Peplink router models. This is a representative sample; the full CVE list may be longer.
CVE-2023-49230
High (CVSS 8.8)
Missing authorization on captive portal settings in the Balance Two before firmware 8.4.0.
CVE-2026-57920
High (CVSS 7.7)
Access-control bypass in the InControl 2 cloud management service, fixed June 3, 2026.
CVE-2023-35193
High (CVSS 7.2)
OS command injection in the Surf SOHO HW1, one of several issues found by Cisco Talos.
CVE-2023-39367
Critical (CVSS 9.1)
Command injection in Peplink Smart Reader v1.2.0.
Frequently Asked Questions
Peplink has had several high and critical-rated flaws since 2023, but none are on CISA's exploited list and no botnet or state-actor campaigns were found. It publishes a vulnerability policy and posts advisories on its forum. Keep firmware updated, and check whether older models still receive releases.
Peplink and Pepwave are subsidiaries of Plover Bay Technologies, a Cayman Islands company listed on the Hong Kong Stock Exchange (1523). Founder and CEO Chan Wing Hong Alex is the controlling shareholder. No state links were found.
Peplink owns no factories. Its CEO said in January 2024 that its devices are manufactured in Taiwan by a global electronics manufacturer, with possible production in Vietnam, Malaysia or Mexico.
Peplink is not on the FCC Covered List and holds no Conditional Approval. Peplink staff said in March 2026 that its enterprise line falls outside the FCC consumer-router rule. FCC guidance counts small-business routers sold at retail as in scope, so smaller models such as the Surf SOHO may be covered. No FCC determination on Peplink was found.
Firmware can be pushed to devices through Peplink's InControl cloud policies. Whether updates install automatically by default is not publicly confirmed.
Sources
Facts on this page come from these sources (publish date, or the date we checked the page).
- Plover Bay Technologies Annual Report 2024 (2025-03-19)
- Peplink forum: supply chain and company security policy (CEO reply) (2024-01-14)
- Peplink forum: staff reply on the FCC router rule (2026-03-26)
- Pepwave Security Vulnerability Policy (accessed 2026-10-07)
- Peplink forum: EOL information (2023-12-28)
- NVD CVE-2023-49230 (2023-12-28)
- NVD CVE-2026-57920 (2026-06-26)
- FCC Covered List (incl. router Conditional Approvals table) (accessed 2026-10-07)
- FCC FAQ: Covered List and routers produced in foreign countries (updated 2026-05-12)
- CISA Known Exploited Vulnerabilities catalog (JSON feed v2026.10.04) (2026-10-04)
CHECK YOUR SPECIFIC MODEL
Get your router's full security report
Check any specific model for CVEs, FCC status, security capabilities, and your personalized action plan.
Check a Router → Top 10 Safe Routers