Peplink Routers Gain iPhone Tethering Support (At Last!) – Firmware 8.5.4 Also Features Urgent Security Fixes

Tethering a cellular phone to a router over USB is a great way to share your phone's internet connection - but while tethering Android devices is widely supported, support for tethering iPhone's to routers has been rare in comparison.

Over a decade (!!!) ago, the Mobile Internet Resource Center challenged RV-focused router manufacturer WiFiRanger to get iPhone tethering support working in their routers - pointing them towards some open source Linux code to build upon that theoretically would make it possible.

WiFiRanger pulled it off - and has supported iOS tethering ever since.

We've been challenging Peplink to deliver this same feature ever since - making this one of our regularly discussed "wish list" features with their team.

Peplink engineering always came back with objections - saying that they could not get iOS tethering working to their reliability standards. Android tethering is easy in comparison.

But we kept nagging - and last October Peplink let us know about a special "pilot phase" test build of firmware 8.5.3 with iOS tethering enabled - which we shared for testing with our community of Mobile Internet Aficionados.

And last week, at last, Peplink made this support official with the release of firmware 8.5.4!

This release also features some urgent security fixes - read on for details... 

Peplink Firmware 8.5.4 - A Surprise Release

Peplink caught all of its partners by surprise with the 8.5.4 firmware release last week, pushing it out with an accelerated one week beta test period - a massive change from the usual 4-8 week long public beta testing process.

Peplink has confirmed to us that 8.5.4 was not planned - and instead they were gearing up for a more significant update to 8.6 that has now been delayed. 

Why the rush?

The release notes reveal the reason - an urgent security fix:

"Fixed a vulnerability in the API that could allow remote code execution"

But rather than just patch the urgent security hole, Peplink included several other pending bug and security fixes too - as well as iOS tethering support.

Peplink 8.5.4 Security Update - More Details

Here is how Peplink describes the security issue and potential attack vector:

"If the user can gain access to the router’s Web Admin with admin privileges, they can execute an API command to perform unauthorized actions.

With InControl Virtual Appliance (ICVA) running firmware up to 2.14.1.2, the Remote Web Admin (RWA) access could give another path to gain access to the vulnerability point."

In other words - the attacker would already need local admin access to your router directly, or access via Peplink's cloud-based InControl management, or via a hacked self-hosted (typically enterprise) InControl Virtual Appliance deployment.

The security issue is considered severe - but most of our typical audience here are not at risk unless their router is paired with a self-hosted InControl cloud management server that has not yet been updated.

PepLink has already closed the hole in their own hosted InControl servers.

iPhone Tethering - At Last!

The one new user-facing feature in firmware 8.5.4 is official support for iPhone tethering.

We have been using this feature in the preview release since October and so far have not had any issues - it is great to be able to add an iPhone as an additional cellular connection when bonding multiple connections together.

The biggest limitation of Peplink's tethering feature is how few Peplink router models have USB ports.

Popular models such as the MAX BR1 Pro have no USB ports, and thus no tethering. But other models, like the B One and MAX BR2 Pro do.

Concluding Thoughts

Even though it might have taken a decade, we are certainly glad that iPhone tethering has at last made the cut to being an official Peplink feature, and not just a sneak preview.

But because of the rushed beta testing - there are more reports than usual in the Peplink community forums of customers discovering issues with 8.5.4.

Unless you need iOS tethering today - since the security hole has been closed via a server patch for most, it is certainly reasonable to hold off on upgrading until things further shake out.

Peplink told us in our most recent call that they were planning a firmware 8.6 beta cycle starting in late February targeting a release in March.

But the work to rush 8.5.4 out will probably delay the 8.6 beta cycle starting by at least two weeks.

Specific details of what's coming in 8.6 have not yet been revealed - MIA members can stay tuned to our special announcements forum for more details when they are available.

Bookmark