OpenWrt

Hi,

The OpenWrt community is proud to announce the newest stable release of the OpenWrt 24.10 stable series.

This release fixes many security issues, several of them remotely triggerable in network services that are enabled by default. We strongly recommend everyone to upgrade.

The OpenWrt 24.10 series is in security maintenance (only security problems are fixed), with end of life (EoL) projected for September 2026. We recommend migrating to OpenWrt 25.12 before then.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=24.10.8

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/24.10.8/targets/

Main changes between OpenWrt 24.10.7 and OpenWrt 24.10.8

Only the main changes are listed below. See changelog-24.10.8 for the full changelog.

Security fixes

This release fixes several remotely triggerable vulnerabilities in core network services that are enabled by default. Updating is strongly recommended.

• odhcpd (DHCPv6/DHCPv4/RA server, enabled by default): multiple vulnerabilities reachable by a network-adjacent, unauthenticated attacker were fixed:
  • CVE-2026-53921 (Critical): stack buffer overflow in the DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST packets. https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496
  • Reconfigure-Accept stack buffer overflow (High, no CVE assigned): the Reconfigure-Accept reply block wrote 36 bytes into the response buffer without checking the remaining space, leading to a pre-auth out-of-bounds write. https://github.com/openwrt/openwrt/security/advisories/GHSA-q6wx-p68j-chp9
  • CVE-2026-53918 (High): use-after-free through a dangling first-lease pointer in the DHCPv6 IA handler. https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2
  • CVE-2026-53920 (High): stack memory disclosure via a truncated DHCPv6 IA_NA/IA_PD option. https://github.com/openwrt/odhcpd/security/advisories/GHSA-p769-5v73-pc4f
  • CVE-2026-53922 (Moderate): pre-auth denial of service via a size_t underflow in DHCPv6 IA handling. https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5
  • Zero-length CLIENT_ARCH option (Moderate, no CVE assigned): stack buffer over-read, and an unaligned read that crashes on strict-alignment targets. https://github.com/openwrt/odhcpd/security/advisories/GHSA-7x9h-5mxm-jg3f
  • NDP hop-limit spoofing (Moderate, CVSS 5.4, no CVE assigned): the NDP relay accepted IPv6 Neighbor Solicitations with a hop limit other than 255 (RFC 4861 violation), letting an off-link attacker spoof NS packets through the relay. Only relevant when the NDP relay is enabled. https://github.com/openwrt/odhcpd/security/advisories/GHSA-qvg7-9jf5-wgjc
• odhcpd / LuCI stored XSS: CVE-2026-62948 (Critical): an unauthenticated DHCPv6 client could inject lease-file lines through a crafted FQDN hostname, resulting in stored cross-site scripting on the LuCI DHCPv6 leases status page. Fixed by escaping client hostnames in the lease state file. https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f
• uhttpd (web server, serves LuCI): three HTTP request smuggling issues on keep-alive connections were fixed:
  • CVE-2026-55614 (High): case-sensitive Transfer-Encoding matching. https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf
  • CVE-2026-55612 (High): invalid chunk-length state reset. https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5
  • CVE-2026-55613 (Moderate): ubus POST body parse-error desync. https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p
  • In addition uhttpd received hardening without an assigned CVE: a one-byte overflow in uh_urldecode(), an off-by-one out-of-bounds read in uh_b64decode(), constant-time password comparison and stricter handling of $p$ crypt-hash entries in the authentication realm.
• rpcd: ACL bypass through symlinks (High): the file plugin matched ACL grants against the textual path but then followed symlinks unchecked, so a symlink inside an ACL-covered directory let a limited account read or write arbitrary root-owned files. The path is now re-resolved and re-authorized for every operation that dereferences the final component. https://github.com/openwrt/openwrt/security/advisories/GHSA-q5gr-86pq-vvwr
• cgi-io (file upload/download helper used by LuCI, installed by default with LuCI):
  • CVE-2026-62947 (Moderate): ACL bypass and arbitrary root file read — the download and exec paths were checked against the ACL before being canonicalized, so path traversal let an authenticated user with wildcard read permission read any root-readable file (e.g. /etc/shadow). https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcq
  • Use-after-free (Moderate, no CVE assigned): decoding malformed percent-encoded POST field data could use freed memory. https://github.com/openwrt/openwrt/security/advisories/GHSA-wvhq-qmwj-grj2
• LuCI (web interface): several issues in LuCI modules and applications were fixed. The privilege-escalation issues only apply if the affected app is installed and a limited (delegated) account with the relevant ACL exists:
  • luci-app-ddns (High): the ucode status backend passed DDNS UCI values such as lookup_host, dns_server and the section name to system() as an unquoted shell string, so anyone able to write DDNS configuration could execute commands as root. The invocations now use the array form of system(). https://github.com/openwrt/openwrt/security/advisories/GHSA-32r4-3wh2-qvq3
  • luci-app-samba4 (High): the read ACL granted exec permission for smbd in general rather than only smbd -V, allowing read-only accounts to run arbitrary commands as root. https://github.com/openwrt/luci/security/advisories/GHSA-vx64-mmp7-h36c
  • luci-app-upnp (High): stored XSS — an unauthenticated LAN client can inject JavaScript through a UPnP port-mapping description, which the underlying daemon does not sanitize. The description is now HTML-escaped. https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89
  • luci-mod-status (High): stored XSS via a DHCP/DHCPv6 lease hostname shown in the lease status tables. Together with the odhcpd fix above this closes the injection path from an unauthenticated DHCP client into the LuCI admin UI. https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh
  • luci-base: the dispatcher now escapes the URL path and user name when logging, so crafted login requests can no longer pollute the system log.
  • The LuCI rpcd ACL files were adjusted for the symlink-aware rpcd ACL check mentioned above, so that /proc paths that are symlinks (such as /proc/mounts) keep working.
• umdns (mDNS responder): CVE-2026-55492 (Moderate, CVSS 6.5): an unauthenticated attacker on the local network segment could flood the daemon with unique mDNS records; the unbounded cache exhausted the heap and took the whole device into out-of-memory. Fixed by bounding the cache size and clamping hostile TTLs. https://github.com/openwrt/mdnsd/security/advisories/GHSA-jg8f-fhfw-jg46
• ead (Emergency Access Daemon): CVE-2026-55490 (Moderate): an integer underflow in handle_send_a() allowed an unauthenticated attacker on the local segment to crash the daemon with a single crafted packet. https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw
• hostapd / wpa_supplicant: the fixes from upstream hostap security advisory 2026-1 were applied. Missing validation of multi-link (MLO / IEEE 802.11be) information in received Management frames could terminate the process or corrupt a small amount of memory; the frames need neither authentication nor user interaction. https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt https://github.com/openwrt/openwrt/security/advisories/GHSA-3hj7-gj5w-h68m
• dropbear (SSH): security fixes from upstream 2026.90 were backported:
  • CVE-2019-6111: a malicious server could make the scp client overwrite unexpected local files (missing OpenSSH patch). Note the accompanying upstream behaviour change: scp -r is now rejected when the target directory already exists.
  • CVE-2026-35385: scp did not clear setuid/setgid bits on received files.
  • An authenticated user could bypass an authorized_keys forced_command option when dropbear runs with -t; authorized_keys is now opened non-blocking (local denial of service via special files); and a close() on a file descriptor obtained from an out-of-bounds read was fixed.
• musl libc: backport of the upstream fixes for CVE-2026-6042 (algorithmic-complexity denial of service in iconv) and CVE-2026-40200 (stack corruption in qsort with sufficiently large inputs).
• OpenSSL: update to 3.0.21, fixing multiple security vulnerabilities (CVE-2026-45447, CVE-2026-34182, CVE-2026-45445, CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-42766, CVE-2026-42770, CVE-2026-45446).
• Linux kernel: update to 6.6.144, pulling in the upstream 6.6.142, 6.6.143 and 6.6.144 stable releases, which fix multiple security vulnerabilities.
• dnsmasq: update to 2.93, which carries the security fixes that were backported into 2.90 in the previous release (CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, CVE-2026-4893 and CVE-2026-5172) plus further upstream fixes.

In addition, the packages feed shipped with this release moved a number of optional packages to newer upstream versions that contain security fixes, among them curl (8.12.1 to 8.19.0), expat (2.7.4 to 2.8.2), BIND (9.20.23 to 9.20.26), PHP 8 (8.3.29 to 8.3.32), Tor (0.4.8.22 to 0.4.9.10), unbound (1.24.2 to 1.25.1), lighttpd (1.4.82 to 1.4.85), haproxy (3.0.19 to 3.0.25) and rsync (3.4.2 to 3.4.3). collectd also received a fix for a use-after-free in the ping plugin. These packages are not part of the default images — you have to update the installed packages on your device to receive them.

Beyond the issues listed above, this release fixes a number of further security and robustness problems in odhcpd, odhcp6c, rpcd and uhttpd for which no CVE number or dedicated advisory was assigned. We strongly recommend upgrading to the latest OpenWrt release and installing all available package updates.

Device support

No new devices were added in this security maintenance release.

Device fixes:

• airoha: update the PCS driver to a newer proposed upstream version (EN7581 Ethernet SerDes)
• ipq806x: Extreme Networks AP3935 - disable PHY hibernation on LAN1, which otherwise stayed dead when no cable was connected at power-on

WiFi fixes and improvements

• mac80211: update the backported wireless stack and drivers from 6.12.61 to 6.12.96, containing many upstream fixes for ath10k, ath11k, rtw88, rtlwifi and iwlwifi, among them:
  • ath10k: skip WMI and beacon transmission when the device is wedged
  • ath11k: fix a warning on unbind and fix peer resolution on the RX path
  • rtw88: fix memory leaks on USB write failures
  • mac80211/nl80211: reject oversized EMA RNR lists and fix multi-link element defragmentation
• hostapd / wpa_supplicant: multi-link (MLO) parsing validation fixes, see the security section above
• wireless-regdb: update to 2026.05.30

Network and service improvements

• odhcpd received many DHCPv6/DHCPv4 correctness and robustness fixes on top of the security fixes listed above, among them bounded nested relay recursion, correct handling of DHCPv4 Pad/End option encoding, fixed reallocation error handling and a memory leak on reload
• odhcp6c: several fixes to DHCPv6 option parsing, RFC 6603 prefix-exclude handling, Reconfigure message validation and script invocation
• rpcd: fixes for a use-after-free in the async exec reply path, a double close of exec pipe descriptors, an integer overflow in the UCI apply timeout and several memory leaks
• umdns: update to a current version with the cache limits mentioned above

Other changes

• busybox: the shell command history is now saved again. To avoid flash wear, it is written only when a shell session exits and it is stored in /tmp, so it is lost on reboot. The location can be changed in /etc/profile.d/busybox-history-file.sh.

Core components update

• Linux kernel: update from 6.6.141 to 6.6.144
• OpenSSL: update from 3.0.20 to 3.0.21 (multiple security fixes, see above)
• dnsmasq: update from 2.90 to 2.93
• mac80211: update from 6.12.61 to 6.12.96
• wireless-regdb: update from 2026.03.18 to 2026.05.30
• ca-certificates: update from 20260223 to 20260601 (refreshed root CA bundle)

Upgrading to 24.10

Sysupgrade can be used to upgrade a device from 23.05 to 24.10, and configuration will be preserved in most cases.

For for upgrades inside the OpenWrt 24.10 stable series for example from a OpenWrt 24.10 release candidate Attended Sysupgrade is supported in addition which allows preserving the installed packages too.

• Sysupgrade from 22.03 to 24.10 is not officially supported.

• There is no configuration migration path for users of the ipq806x target for Qualcomm Atheros IPQ806X SoCs because it switched to DSA. You have to upgrade without saving the configuration. ''Image version mismatch. image 1.1 device 1.0 Please wipe config during upgrade (force required) or reinstall. Config cannot be migrated from swconfig to DSA Image check failed''

• User of the Linksys E8450 aka. Belkin RT3200 running OpenWrt 23.05 or earlier will need to run installer version v1.1.3 or later in order to reorganize the UBI layout for the 24.10 release. A detailed description is in the OpenWrt wiki. Updating without using the installer will break the device. Sysupgrade will show a warning before doing an incompatible upgrade.

• Users of the Xiaomi AX3200 aka. Redmi AX6S running OpenWrt 23.05 or earlier have to follow a special upgrade procedure described in the wiki. This will increase the flash memory available for OpenWrt. Updating without following the guide in the wiki break the device. Sysupgrade will show a warning before doing an incompatible upgrade.

• Users of Zyxel GS1900 series switches running OpenWrt 23.05 or earlier have to perform a new factory install with the initramfs image due to a changed partition layout. Sysupgrade will show a warning before doing an incompatible upgrade and is not possible. After upgrading, the config file /etc/config/system should not be restored from a backup, as this will overwrite the new compat_version value.

• Users of scp from the dropbear package: recursive copies (scp -r) into an already existing target directory are now rejected. This is an intentional upstream change that comes with the fix for CVE-2019-6111. Use rsync or copy into a non-existing directory instead.

Known issues

• LEDs for Airoha AN8855 are not yet supported. Devices like the Xiaomi AX3000T with an Airoha switch will have their switch LEDs powered off. This will not be addressed in the OpenWrt 24.10 series any more, it is fixed in OpenWrt 25.12.
• 5GHz WiFi is non-functional on certain devices with ath10k chipsets. Affected models include the Phicomm K2T, TP-Link Archer C60 v3 and possibly others. For details, see issue #14541.

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/24.10/notes-24.10.8

In particular, make sure to read the regressions and known issues before upgrading: https://openwrt.org/releases/24.10/notes-24.10.8#known_issues

For a detailed list of all changes since 24.10.7, refer to https://openwrt.org/releases/24.10/changelog-24.10.8

To download the 24.10.8 images, navigate to: https://downloads.openwrt.org/releases/24.10.8/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=24.10.8

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the fifth service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.5

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.5/targets/

Main changes between OpenWrt 25.12.4 and OpenWrt 25.12.5

Only the main changes are listed below. See the full changelog for details.

Security fixes

This release fixes several remotely triggerable vulnerabilities in core network services that are enabled by default. Updating is strongly recommended.

• odhcpd (DHCPv6/DHCPv4/RA server, enabled by default): multiple vulnerabilities reachable by a network-adjacent attacker were fixed by updating odhcpd:
  • CVE-2026-53921 (Critical): stack buffer overflow in the DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST packets. https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496
  • CVE-2026-53918 (High): use-after-free in the DHCPv6 IA handler. https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2
  • CVE-2026-53920 (High): stack memory disclosure via a truncated DHCPv6 IA_NA/IA_PD option. https://github.com/openwrt/odhcpd/security/advisories/GHSA-p769-5v73-pc4f
  • CVE-2026-53922 (Moderate): pre-auth denial of service via a size_t underflow in DHCPv6 IA handling. https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5
  • CVE-2026-55606 (Moderate): stack buffer overread caused by a DUID length endianness mismatch. https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45
  • No CVE assigned (Moderate, CVSS 5.4): the NDP relay accepted IPv6 Neighbor Solicitations with a hop limit other than 255 (RFC 4861 violation), letting an off-link attacker spoof NS packets through the relay (neighbor-cache poisoning, traffic redirection or DoS). Only relevant when the NDP relay is enabled. https://github.com/openwrt/odhcpd/security/advisories/GHSA-qvg7-9jf5-wgjc
• odhcpd / LuCI stored XSS (Critical): an unauthenticated DHCPv6 client could inject lease-file lines through a crafted FQDN hostname, resulting in stored cross-site scripting on the LuCI DHCPv6 leases status page. Fixed by escaping client hostnames in the lease state file. https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f
• uhttpd (web server): three HTTP request smuggling issues on keep-alive connections were fixed:
  • CVE-2026-55612 (High): invalid chunk-length state reset. https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5
  • CVE-2026-55614 (High): case-sensitive Transfer-Encoding matching. https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf
  • CVE-2026-55613 (Moderate): ubus POST body parse-error desync. https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p
• cgi-io: ACL bypass / arbitrary file read (Moderate): a path-traversal flaw in the cgi-download handler let an authenticated user with wildcard read permission read any root-readable file (e.g. /etc/shadow). https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcq
• LuCI (web interface): a set of issues in LuCI core modules and applications were fixed. Most let a logged-in user with limited (delegated) permissions escalate to root command execution; a few are stored XSS issues reachable by clients on the network. The privilege-escalation issues only apply if the affected app is installed and the account/ACL in question exists:
  • luci-app-tailscale-community (Critical, CVSS 9.9): command injection allowing delegated users to run commands as root via tailscale.do_login. https://github.com/openwrt/luci/security/advisories/GHSA-xwc5-mx58-rh35
  • luci-app-advanced-reboot (High): CVE-2026-55897 — a read ACL exposes /bin/sh via file.exec, allowing delegated users to run commands as root. https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6
  • luci-app-adblock-fast (High): CVE-2026-55159 — delegated users can reach root command execution via newline-separated cron entries. https://github.com/openwrt/luci/security/advisories/GHSA-ggpf-xrph-wg5v
  • luci-app-samba4 (High): a read ACL allows authenticated root command execution via the smbd file.exec permission. https://github.com/openwrt/luci/security/advisories/GHSA-vx64-mmp7-h36c
  • luci-app-travelmate (High): a delegated UCI write can execute the travelmate auto-login command as root. https://github.com/openwrt/luci/security/advisories/GHSA-p35r-3323-6g7g
  • luci-app-upnp (High): stored XSS — an unauthenticated LAN client can inject JavaScript via a UPnP port-mapping description. https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89
  • luci-mod-network / luci-mod-status (High): stored XSS via a DHCPv6 lease hostname (FQDN) shown in the status tables. https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh
  • luci-app-banip (High): a crafted LuCI login username can inject an arbitrary IP into banIP's log parser, causing the wrong address to be blocked. https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m
• ead (Emergency Access Daemon): CVE-2026-55490 (Moderate): an integer underflow in handle_send_a() allowed a pre-auth denial of service. https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw
• Linux kernel: update to 6.12.94, pulling in the upstream 6.12.88 through 6.12.94 stable releases, which fix multiple security vulnerabilities, such as CVE-2026-43500.
• OpenSSL: update to 3.5.7, fixing multiple security vulnerabilities (CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447).
• musl libc: backport upstream fixes for CVE-2026-6042 and CVE-2026-40200.
• dropbear (SSH): backport security fixes from upstream 2026.90 and 2026.91, including CVE-2019-6111 (a malicious server could trick the scp client into overwriting arbitrary local files) and CVE-2026-35385.

Beyond the issues listed above, this release fixes a number of further security problems for which no CVE number or dedicated advisory was assigned. We strongly recommend upgrading to the latest OpenWrt release and installing all available package updates.

Device support

New devices supported in 25.12.5:

• ipq40xx: Linksys MR9000
• mediatek (filogic): GL.iNET GL-MT3600BE
• mediatek (filogic): Huasifei WH3000R (NAND)
• mediatek (filogic): JioRouter AX6000 (JIDU6101)
• mediatek (filogic): netis EAP930 V1
• mediatek (filogic): netis MEX605
• mediatek (filogic): TP-Link F65 v1
• mediatek (filogic): Zbtlink ZBT-Z8106AX-S
• mvebu: Zyxel NAS326
• ramips (mt76x8): Cudy WR300 v1
• ramips (mt7621): I-O DATA WN-AX2033GR2

New image variants for already supported devices:

• mediatek (filogic): Qihoo 360T7 - add UBI layout image
• mediatek (filogic): Creatlentem CLT-R30B1 - add all-in-UBI layout image
• mediatek (filogic): Bazis AX3000WM - also recognized under its alternative name WD-R3000N-G2A

Device fixes:

• ath79: MikroTik - build AG71XX_LEGACY as a module, fixing AR8216/AR8236/AR8316 switch bring-up on boot on some MikroTik devices (https://github.com/openwrt/openwrt/issues/23739)
• mediatek: do not let devfreq power off the CPU (stability fix)
• mediatek (filogic): Wavlink WL-WN536AX6 rev A - several fixes (correct 5 GHz MAC address, MAC-address nvmem layout, NAND bad-block management, SPI drive strength, network LED)
• mediatek (filogic): Qihoo 360T7 - fix DDR3 rate
• mediatek: Acer Predator W6X - add LED boot status support
• ramips: PAX1800 Lite - fix label MAC device and avoid attaching both UBI partitions on boot
• ramips (mt76x8): Cudy LT300 v3 - fix backup partition offset
• rtl8367b: fix RTL8367S-VB VLAN multicast memory handling
• mvebu: uDPU / eDPU - convert to dual (A/B) firmware
• ipq806x: AP3935 - disable hibernation on LAN1
• airoha (an7581): platform improvements and upstream networking fixes

WiFi fixes and improvements

• wifi-scripts: fix a null dereference on 6 GHz-only radios
• wifi-scripts: fix EAP (802.1X) station mode in the wpa_supplicant configuration generator
• wifi-scripts: fix tracking of disabled virtual interfaces
• hostapd: fix a misplaced radar-detected (DFS) ubus notification

Network and service improvements

• New "network" LED trigger (lan/wan/wlan) for link and activity indication on supported devices
• odhcpd and odhcp6c received many DHCPv6/DHCPv4 and IPv6 prefix-delegation correctness and robustness fixes, on top of the security fixes listed above, including more stable DHCPv6 IAID handling
• More robust handling of invalid DHCP / DHCPv6 client identifiers
• ubus, rpcd, uhttpd, umdns, uclient and fstools updated with stability and hardening fixes

Other changes

• kmod-nf-nathelper-extra was split into individual per-protocol packages, so only the needed NAT helper modules have to be installed.
• Matching the linker max-page-size to the target page size removes unnecessary padding, which can make many binaries - and thus the images - a bit smaller.
• OpenWrt builds are now more reproducible.

Core component updates

• Linux kernel: update from 6.12.87 to 6.12.94
• OpenSSL: update from 3.5.6 to 3.5.7 (multiple security fixes, see above)
• wireless-regdb: update from 2026.03.18 to 2026.05.30
• dnsmasq: update from 2.91 to 2.93
• ca-certificates: update from 20260223 to 20260601 (refreshed root CA bundle)
• util-linux: update from 2.41.3 to 2.41.5

Upgrading to 25.12.5

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts. For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. https://github.com/openwrt/openwrt/commit/fc0c518a88e68d3deef04bec73b33d35186d6546

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. https://github.com/openwrt/openwrt/commit/cd8dcfef378044a1687adfa3738f01f9a9622baf

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

• Meraki MX60: Direct sysupgrade to 25.12.5 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.

• Sitecom WLR-7100 (X7 AC1200): This device was moved from the ath79/generic target to the ath79/tiny target in OpenWrt 25.12.4. Users upgrading from 25.12.3 or earlier need to flash the new image from the ath79/tiny target (use sysupgrade -F).

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. https://github.com/openwrt/openwrt/issues/22344

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.5

In particular, make sure to read the known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.5#known_issues

For a detailed list of all changes, refer to https://openwrt.org/releases/25.12/changelog-25.12.5

To download the 25.12.5 images, navigate to: https://downloads.openwrt.org/releases/25.12.5/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.5

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the newest stable release of the OpenWrt 24.10 stable series.

This release fixes several security issues, including security fixes in dnsmasq and the Linux kernel. We recommend everyone to upgrade.

The OpenWrt 24.10 series is in security maintenance (only security problems are fixed), with end of life (EoL) projected for September 2026. We recommend migrating to OpenWrt 25.12 before then.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=24.10.7

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/24.10.7/targets/

Main changes between OpenWrt 24.10.6 and OpenWrt 24.10.7

Only the main changes are listed below. See changelog-24.10.7 for the full changelog.

Security fixes

Linux kernel:

• CVE-2026-43284 ("Dirty Frag"): local privilege escalation through the IPsec ESP code path. This only affects devices that use IPsec, i.e. that have kmod-ipsec / the esp4 or esp6 kernel modules loaded. Fixed by the Linux kernel update to 6.6.138.
• CVE-2026-31431 ("Copy Fail"): in earlier releases this only affected users of the starfive target and users who had installed kmod-crypto-user. Fixed by the Linux kernel update to 6.6.137.

dnsmasq:

• Multiple upstream security fixes backported to dnsmasq 2.90: CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, CVE-2026-4893 and CVE-2026-5172.

TLS/crypto libraries:

• openssl: update to 3.0.20, fixing multiple security vulnerabilities
• mbedtls: update to 3.6.6, fixing multiple security vulnerabilities
• wolfssl: update to 5.9.1, fixing multiple security vulnerabilities

Device support

• airoha: an7581: enable USB support
• airoha: EN7581: fix PCIe initialization and add x2 lane (x2 link) support
• airoha: add U-Boot support for EN7581/AN7583 boards
• bcm53xx: align image names with the device-tree compatible (affects image selection in the Firmware Selector)
• qualcommax: ipq807x: Linksys MX5300: fix MAC address labelling
• ramips: mt7621: Xiaomi Mi Router AC2100: fix MAC address labelling

Various fixes and improvements

• airoha: an7581: fix kernel panic in the I2S audio driver
• airoha: fix Ethernet hardware offload on EN7581 (backported upstream airoha_eth patches, offload with GDM2 present)
• lantiq: fix refcount and memory leak in the MTD partition parser
• wifi-scripts: fix MAC address check in the mac80211 setup script

Core components update

• Linux kernel: update from 6.6.127 to 6.6.141
• ca-certificates: update from 20250419 to 20260223
• mbedtls: update from 3.6.5 to 3.6.6
• openssl: update from 3.0.19 to 3.0.20
• wireless-regdb: update from 2026.02.04 to 2026.03.18
• wolfssl: update from 5.7.6 to 5.9.1

Upgrading to 24.10

Sysupgrade can be used to upgrade a device from 23.05 to 24.10, and configuration will be preserved in most cases.

For for upgrades inside the OpenWrt 24.10 stable series for example from a OpenWrt 24.10 release candidate Attended Sysupgrade is supported in addition which allows preserving the installed packages too.

• Sysupgrade from 22.03 to 24.10 is not officially supported.

• There is no configuration migration path for users of the ipq806x target for Qualcomm Atheros IPQ806X SoCs because it switched to DSA. You have to upgrade without saving the configuration. ''Image version mismatch. image 1.1 device 1.0 Please wipe config during upgrade (force required) or reinstall. Config cannot be migrated from swconfig to DSA Image check failed''

• User of the Linksys E8450 aka. Belkin RT3200 running OpenWrt 23.05 or earlier will need to run installer version v1.1.3 or later in order to reorganize the UBI layout for the 24.10 release. A detailed description is in the OpenWrt wiki. Updating without using the installer will break the device. Sysupgrade will show a warning before doing an incompatible upgrade.

• Users of the Xiaomi AX3200 aka. Redmi AX6S running OpenWrt 23.05 or earlier have to follow a special upgrade procedure described in the wiki. This will increase the flash memory available for OpenWrt. Updating without following the guide in the wiki break the device. Sysupgrade will show a warning before doing an incompatible upgrade.

• Users of Zyxel GS1900 series switches running OpenWrt 23.05 or earlier have to perform a new factory install with the initramfs image due to a changed partition layout. Sysupgrade will show a warning before doing an incompatible upgrade and is not possible. After upgrading, the config file /etc/config/system should not be restored from a backup, as this will overwrite the new compat_version value.

Known issues

• LEDs for Airoha AN8855 are not yet supported. Devices like the Xiaomi AX3000T with an Airoha switch will have their switch LEDs powered off. This issue will be addressed in an upcoming OpenWrt SNAPSHOT and the OpenWrt 24.10 minor release.
• 5GHz WiFi is non-functional on certain devices with ath10k chipsets. Affected models include the Phicomm K2T, TP-Link Archer C60 v3 and possibly others. For details, see issue #14541.

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/24.10/notes-24.10.7

In particular, make sure to read the regressions and known issues before upgrading: https://openwrt.org/releases/24.10/notes-24.10.7#known_issues

For a detailed list of all changes since 24.10.6, refer to https://openwrt.org/releases/24.10/changelog-24.10.7

To download the 24.10.7 images, navigate to: https://downloads.openwrt.org/releases/24.10.7/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=24.10.7

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the fourth service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.4

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.4/targets/

Main changes between OpenWrt 25.12.3 and OpenWrt 25.12.4

Only the main changes are listed below. See the full changelog for details.

Security fixes

• dnsmasq: backport six upstream CVE-fix patches to dnsmasq 2.91:
  • CVE-2026-2291: heap buffer overflow in DNS domain-name handling.
  • CVE-2026-4890 / CVE-2026-4891: DNSSEC crashes via crafted NSEC bitmaps / RRSIG packets.
  • CVE-2026-4892: buffer overflow on large DHCPv6 CLIDs (only with --dhcp-script).
  • CVE-2026-4893: broken EDNS Client Subnet validation.
  • CVE-2026-5172: buffer overflow in extract_addresses() on crafted resource records.
• Linux kernel: CVE-2026-43284 ("Dirty Frag") — local privilege escalation via the IPsec ESP path. Only relevant on devices with kmod-ipsec / esp4/esp6 loaded. Fixed via the 6.12.87 kernel update.

Device support

New devices supported in 25.12.4:

• ath79: MikroTik RouterBOARD 960PGS (hEX PoE / PowerBox Pro)
• mediatek: filogic: Cudy WR3000E v1: add ubootmod variant
• mediatek: filogic: Cudy WR3000H v1: add ubootmod variant
• mediatek: filogic: Cudy WR3000P v1: add ubootmod variant
• mediatek: filogic: Cudy WR3000S v1: add ubootmod variant

Device fixes:

• ath79: Sitecom WLR-7100 (X7 AC1200): fix MAC address assignment, wire up 5 GHz WLAN LED, and move to the tiny target to free ~800 KiB of flash
• ipq40xx: Pakedge WR-1: restore lost band label on the WLAN LEDs
• mediatek: filogic: Cudy WR3000E/H/P/S v1 and WBR3000UAX v1 (ubootmod NAND builds): disable NMBM, which was mistakenly enabled and prevented the NAND from being used correctly
• microchipsw: fix LAN8814 QSGMII soft reset

WiFi fixes and improvements

• wifi-scripts: fix basic_rate mapping in the wpa_supplicant ucode generator
• mac80211: update backports package to 6.18.26 (general stability improvements)

Core component updates

• Linux kernel: update from 6.12.85 to 6.12.87
• mac80211: update from 6.18.7 to 6.18.26

Upgrading to 25.12.4

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts. For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. https://github.com/openwrt/openwrt/commit/fc0c518a88e68d3deef04bec73b33d35186d6546

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. https://github.com/openwrt/openwrt/commit/cd8dcfef378044a1687adfa3738f01f9a9622baf

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

• Meraki MX60: Direct sysupgrade to 25.12.4 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. https://github.com/openwrt/openwrt/issues/22344

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.4

In particular, make sure to read the known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.4#known_issues

For a detailed list of all changes, refer to https://openwrt.org/releases/25.12/changelog-25.12.4

To download the 25.12.4 images, navigate to: https://downloads.openwrt.org/releases/25.12.4/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.4

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the third service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.3

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.3/targets/

Main changes between OpenWrt 25.12.2 and OpenWrt 25.12.3

Only the main changes are listed below. See the full changelog for details.

Security fixes

• Linux kernel: fixes CVE-2026-31431 ("Copy Fail"). In earlier releases this only affected users on the starfive target and users who had installed kmod-crypto-user.
• mbedtls: update to 3.6.6 (multiple CVE fixes)
• OpenSSL: update to 3.5.6 (multiple CVE fixes)
• wolfSSL: update to 5.9.1 (multiple CVE fixes)

Device support

New devices supported in 25.12.3:

• mediatek: filogic: ASUS RT-AX52 PRO
• mediatek: filogic: D-Link AQUILA PRO AI E30
• mediatek: filogic: Huasifei WH3000 Pro (NAND variant)
• mediatek: filogic: Keenetic KAP-630 / Netcraze NAP-630
• mediatek: filogic: Zbtlink ZBT-Z8106AX-T
• mediatek: filogic: Zyxel WX5600-T0
• ramips: mt7621: EDUP EP-RT2983
• ramips: mt76x8: Cudy LT300 v3
• x86: DFI ADN553
• x86: DFI ASL553

Device fixes:

• ath79: Netgear WNDAP360: multiple fixes restoring proper operation (sysupgrade, kernel loader, ethernet, LED, serial baud rate and U-Boot environment)
• ath79: Extreme Networks WS-AP3805i: fix U-Boot environment configuration
• ath79: Mikrotik: fix included device packages
• ipq50xx: Linksys MX5500: add label MAC device assignment
• lantiq: Netgear DGN3500: fix U-Boot environment size — device was broken on 25.12 (https://github.com/openwrt/openwrt/issues/22692)
• mediatek: filogic: Bananapi BPI-R4: add device tree overlay for the BE14 WiFi 7 module — fixes very low WiFi TX power on this module (https://github.com/openwrt/openwrt/issues/17489)
• mediatek: filogic: Keenetic KN-1812: various Ethernet PHY device tree fixes (PHY reset, interrupt support, MDIO drive strength, partition naming, xsphy node)
• mediatek: filogic: Netgear EAX17: fix rootfs hash in FIT node for per-device rootfs builds
• mediatek: filogic: CMCC RAX3000M: add Airoha AN8855 switch support (https://github.com/openwrt/openwrt/issues/21230)
• mediatek: filogic: Zbtlink ZBT-Z8103AX-D: enable NMBM on the SPI-NAND flash
• mvebu: ClearFog Base/Pro: fix switch kernel module
• qualcommax: ipq50xx: Xiaomi AX6000: enable PCIe1 for QCA9887
• qualcommax: ipq807x: Linksys MX5300: add label MAC assignment
• ramips: Yuncore CPE200: fix EEPROM size
• ramips: mt7621: fix reset hang
• ramips: Wavlink WL-WN575A3: fix EEPROM size for 5 GHz WiFi
• ramips: Xiaomi Mi Router 4C: fix WAN LED GPIO (https://github.com/openwrt/openwrt/issues/18578)

WiFi fixes and improvements

• wifi-scripts: fix incorrect erp_domain and fils_cache_id values generated by the ucode-based config script (https://github.com/openwrt/openwrt/issues/21768)
• wifi-scripts: add missing bridge_isolate and network_vlan fields to the ucode schema (https://github.com/openwrt/openwrt/issues/22620)
• wifi-scripts: add missing iface and other fields to the ucode station/vlan schema (https://github.com/openwrt/openwrt/issues/22165)
• wifi-scripts: add EHT (WiFi 7) rates to set_fixed_freq

Networking and system fixes

• mbedtls: backport upstream patches to fix TLS 1.2 client issues — fixes a regression that broke DDNS updates and other TLS 1.2 client connections; the regression was introduced in mbedtls package updates shipped after the 25.12.2 release (https://github.com/openwrt/openwrt/issues/22874)
• base-files: sysupgrade: fix -u option (skip default configuration) which was broken with apk
• base-files: sysupgrade: fix -f (custom backup) when the path contains spaces
• base-files: sysupgrade: update backup exclusion list
• base-files: use DISKSEQ instead of MAJOR/MINOR for stable disk identification (MAJOR/MINOR are not sequential)
• lantiq: fix mtdparsers refcount and memory leak
• uqmi / umbim: introduce devpath option for selecting cellular modems by USB device path
• kernel: add kmod-vsock and kmod-vsock-virtio for VM guests (vsock communication)

Core component updates

• Linux kernel: update from 6.12.74 to 6.12.85
• ca-certificates: update from 20250419 to 20260223
• linux-firmware: update from 20251125 to 20260221
• mbedtls: update from 3.6.5 to 3.6.6 (security fixes)
• OpenSSL: update from 3.5.5 to 3.5.6 (security fixes)
• wireless-regdb: update from 2026.02.04 to 2026.03.18
• wolfSSL: update from 5.8.4 to 5.9.1 (security fixes)
• xdp-tools: update from 1.4.3 to 1.6.3

Upgrading to 25.12.3

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts. For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. https://github.com/openwrt/openwrt/commit/fc0c518a88e68d3deef04bec73b33d35186d6546

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. https://github.com/openwrt/openwrt/commit/cd8dcfef378044a1687adfa3738f01f9a9622baf

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

• Meraki MX60: Direct sysupgrade to 25.12.3 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. https://github.com/openwrt/openwrt/issues/22344

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.3

In particular, make sure to read the known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.3#known_issues

For a detailed list of all changes, refer to https://openwrt.org/releases/25.12/changelog-25.12.3

To download the 25.12.3 images, navigate to: https://downloads.openwrt.org/releases/25.12.3/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.3

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the second service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.2

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.2/targets/

Main changes between OpenWrt 25.12.1 and OpenWrt 25.12.2

Only the main changes are listed below. See the full changelog for details.

Device support

• airoha: rename kernel module kmod-pwm-an7581 to kmod-pwm-airoha — users with this module explicitly installed need to reinstall under the new name
• apm821xx: fix U-Boot environment definitions for NETGEAR WNDR4700, Western Digital MyBookLive, Meraki MR24 and Meraki MX60; fix PCIe boot failure on Meraki MX60
• ath79: fix initramfs boot for Huawei AP5030DN and AP6010DN
• ath79: fix VLAN CPU port tagging on 2-CPU-port devices (affects several dual-CPU switch configurations)
• ath79: remove incorrectly included WiFi packages from Mikrotik RB750r2 (device has no WiFi hardware)
• ipq40xx: fix ART partition name for Linksys Velop WHW03 V1 — restores correct WiFi calibration data access
• ipq40xx: fix MAC address reading for Linksys devices using eMMC-based NVMEM
• lantiq: xrx200: fix failsafe mode on BT HomeHub 5A — LAN ports 1 & 2 now work correctly in failsafe (https://github.com/openwrt/openwrt/issues/22480)
• mediatek: Bananapi BPI-R4: fix SFP+ electric module support — modules that stopped working after a snapshot upgrade are now functional again (https://github.com/openwrt/openwrt/issues/19878)
• ramips: fix kernel decompress error that bricked ELECOM WRC-X1800GS on 25.12.0 (https://github.com/openwrt/openwrt/issues/22270)
• ramips: fix initramfs kernel load address for TP-Link EAP615-Wall v1
• ramips: fix MAC address assignment for Xiaomi Mi AC2100
• realtek: fix D-Link fan control script

WiFi fixes and improvements

• wifi-scripts: fix 160 MHz channel width configuration — hostapd was not correctly configured for 160 MHz, preventing its use (https://github.com/openwrt/openwrt/issues/22481)
• wifi-scripts: fix SU beamformee antenna count — incorrect count was passed to the driver
• hostapd: fix memory leak in Radio Resource Management (RRM) ubus interface
• mac80211: ath12k: add thermal sensor support for QCA/IPQ devices
• mac80211: ath9k: fix GPIO mask handling from device tree
• mt76: fix severe WiFi latency regression (up to multiple seconds) on 2.4 GHz introduced in 25.12.1 — affected many MediaTek devices including OpenWrt One, Zyxel EX5601, ASUS RT-AX53U, Xiaomi AX3000T/AX6000, Cudy WR3000/X6, GL Flint 2 and others (https://github.com/openwrt/openwrt/issues/22491)
• mt76: multiple further stability fixes for MediaTek WiFi chipsets (MT7615/MT7915/MT7996/MT7992/MT792x):
  • add per-link beacon monitoring for MLO (Multi-Link Operation)
  • fix MT7996/MT7992 link handling during MLO station add/remove
  • fix scan work requeue race with spinlock

Upgrading to 25.12.2

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts. For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. https://github.com/openwrt/openwrt/commit/fc0c518a88e68d3deef04bec73b33d35186d6546

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. https://github.com/openwrt/openwrt/commit/cd8dcfef378044a1687adfa3738f01f9a9622baf

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

• Meraki MX60: Direct sysupgrade to 25.12.2 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. https://github.com/openwrt/openwrt/issues/22344

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.2

In particular, make sure to read the known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.2#known_issues

For a detailed list of all changes, refer to https://openwrt.org/releases/25.12/changelog-25.12.2

To download the 25.12.2 images, navigate to: https://downloads.openwrt.org/releases/25.12.2/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.2

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the first service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.1

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.1/targets/

Main changes between OpenWrt 25.12.0 and OpenWrt 25.12.1

Only the main changes are listed below. See the full changelog for details.

Security fixes

OpenWrt components (Trail of Bits audit, February 2026):

• CVE-2026-30871: Stack buffer overflow in umdns DNS PTR query handling (HIGH)
• CVE-2026-30872: Stack buffer overflow in umdns IPv6 reverse DNS lookup (HIGH)
• CVE-2026-30873: Memory leak in jsonpath when processing strings, labels, and regexp tokens (LOW)
• CVE-2026-30874: Command execution via PATH environment variable filter bypass in procd (LOW)

LuCI:

• CVE-2026-32721: Possible XSS attack via malicious SSID in LuCI WiFi scan modal (HIGH)

Additional hardening from the same Trail of Bits audit (no CVE assigned):

• odhcpd: fix stack buffer overflow in DHCPv6 Identity Association logging
• procd: fix out-of-bounds write in cgroup path building and cgroup rule application

Device support

• airoha: fix EN7581 PCIe initialization and add x2 (2-lane) link support — improves PCIe reliability and unlocks full bandwidth for affected devices
• ath79: TP-Link RE355 v1, RE450 v1/v2: fix partition alignment to prevent configuration loss on sysupgrade
• ipq40xx: Devolo Magic 2 WiFi next: enable device support
• ipq40xx: re-enable MeshPoint.One target
• ipq806x: AP3935: fix U-Boot NVMEM layout
• lantiq: fix GPIO expander clock (gpio-stp-xway) — restores correct LED and GPIO behaviour on affected devices
• lantiq: fix missing WAN MAC address assignment on some devices
• mediatek: Cudy M3000: add support for hardware variant with Motorcomm YT8821 PHY (previously only the Realtek PHY variant was supported)
• mediatek: TP-Link BE450: fix 10GbE PHY reset timing that caused intermittent boot stalls, add missing WLAN toggle button, fix reported memory size
• microchipsw: Novarq Tactical 1000: fix swapped SFP I2C buses for ports 1 and 3 — fixes SFP EEPROM read failures
• ramips: Keenetic KN-1910: fix sysupgrade functionality
• realtek: RTL838x-based switches: fix non-functional reboot
• treewide: Linksys devices: fix MAC address assignment

WiFi fixes and improvements

• mac80211: fix crash triggered by Channel Switch Announcement (CSA) when AP VLAN interfaces are in use
• mt76: add MT7990 firmware support (new MediaTek WiFi 7 chipset)
• mt76: mt7915: fix power save mode handling
• mt76: mt7921/MT7902: add MT7902e MCU and DMA layout support
• mt76: mt7996/mt7992: fix crash in transmit path, fix out-of-bounds access during hardware restart, improve MLO/CSA and radar detection support
• wifi-scripts: fix incorrect VHT160 capability advertisement — was incorrectly set on non-160 MHz AP configurations, degrading station upload speed (https://github.com/openwrt/openwrt/issues/22435)
• wifi-scripts: fix malformed wpa_supplicant config when 802.1X EAP credentials (identity, password, certificates) contain spaces (https://github.com/openwrt/openwrt/issues/22212)

Web interface (LuCI) and system fixes

• luci-mod-network: fix XSS vulnerability in WiFi scan modal (CVE-2026-32721)
• ustream-ssl (OpenSSL variant): fix use-after-free crash causing uhttpd (the LuCI web server) to crash under high load (https://github.com/openwrt/openwrt/issues/19349)

Networking and system fixes

• firewall4: set as the preferred firewall package over the legacy firewall package
• iptables: prefer the nftables-backed variants (iptables-nft, ip6tables-nft) when iptables is pulled in as a dependency
• kernel: CAKE QoS scheduler fixes — avoid unnecessary synchronization overhead when running without a rate limit, fix DiffServ rate scaling
• kernel: SFP: improve Huawei MA5671a module support — module is now accessible even when no fiber is connected
• odhcpd: fix segfault when disabling a DHCP interface, fix DHCPv4 lease tree corruption, fix truncated field in DHCPv6 lease queries, fix DNS search list padding
• ppp: fix potential memory safety issue (undefined behavior in memcpy with overlapping buffers); remove the MRU limit patch for PPPoE connections (https://github.com/ppp-project/ppp/pull/573)

Package manager (apk)

• apk: update to version 3.0.5 with several OpenWrt-specific bug fixes
• apk: add --force-reinstall option to reinstall already-installed packages without requiring a version change

Core component updates

• apk: update from 3.0.2 to 3.0.5
• jsonfilter: update from 2025-10-04 to 2026-03-16 (fixes CVE-2026-30873)
• libubox: update from 2026-02-13 to 2026-03-13 (ABI version stabilized for 25.12 stable series)
• Linux kernel: update from 6.12.71 to 6.12.74
• odhcpd: update from 2026-01-19 to 2026-03-16
• omcproxy: update from 2025-10-04 to 2026-03-07
• procd: update from 2026-02-20 to 2026-03-14 (fixes CVE-2026-30874)
• umdns: update from 2025-10-04 to 2026-02-06 (fixes CVE-2026-30871, CVE-2026-30872)
• ustream-ssl: update from 2025-10-03 to 2026-03-01

Upgrading to 25.12.1

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts. For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. https://github.com/openwrt/openwrt/commit/fc0c518a88e68d3deef04bec73b33d35186d6546

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. https://github.com/openwrt/openwrt/commit/cd8dcfef378044a1687adfa3738f01f9a9622baf

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. https://github.com/openwrt/openwrt/issues/22344
• 160 MHz channel width cannot be configured. https://github.com/openwrt/openwrt/issues/22481

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.1

In particular, make sure to read the known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.1#known_issues

For a detailed list of all changes, refer to https://openwrt.org/releases/25.12/changelog-25.12.1

To download the 25.12.1 images, navigate to: https://downloads.openwrt.org/releases/25.12.1/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.1

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the newest stable release of the OpenWrt 24.10 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=24.10.6

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/24.10.6/targets/

Main changes between OpenWrt 24.10.5 and OpenWrt 24.10.6

Only the main changes are listed below. See changelog-24.10.6 for the full changelog.

Security fixes

OpenWrt components (Trail of Bits audit, February 2026):

• CVE-2026-30871: Stack buffer overflow in umdns DNS PTR query handling (HIGH)
• CVE-2026-30872: Stack buffer overflow in umdns IPv6 reverse DNS lookup (HIGH)
• CVE-2026-30873: Memory leak in jsonpath when processing strings, labels, and regexp tokens (LOW)
• CVE-2026-30874: Command execution via PATH environment variable filter bypass in procd (LOW)

LuCI:

• CVE-2026-32721: Possible XSS attack via malicious SSID in LuCI WiFi scan modal (MEDIUM)

OpenSSL:

• openssl: update to 3.0.19, fixing multiple security vulnerabilities

Device support

• airoha: an7581: fix switch port and LED functionality
• ath79: CF-EW71 v2: fix MAC address assignment
• imx: Gateworks Venice GW72xx-2x, GW73xx-2x, GW75xx-0x, GW75xx-2x: add sysupgrade support
• ipq40xx: ASUS Lyra: fix reading of WiFi calibration data
• lantiq: fix GPIO expander clock, restoring correct LED and GPIO behaviour on affected devices
• mediatek: Banana Pi BPi-R3: fix PWM fan speed control — medium cooling level now works correctly
• mediatek: Cudy AP3000 v1, Cudy WR3000H: fix Ethernet connectivity on units with a Motorcomm PHY
• mediatek: Cudy M3000, ramips: Cudy AP1300 Outdoor: fix incorrect Ethernet port assignment
• mediatek: Cudy WR3000P: enable USB 3.0 support in default firmware image
• mediatek: GL-MT2500: fix sysupgrade compatibility from earlier releases
• mt7620: fix potential crash on MT7620-based devices
• ramips: mt76x8: fix boot counter tracking
• realtek: GS1900-24E: fix switch reliability

Various fixes and improvements

• imx: cortexa53: fix memory allocation for DMA-intensive operations
• jsonpath: fix memory leak (CVE-2026-30873)
• mac80211: ath11k: fix crash caused by unsupported 11ax EDCA parameters
• mac80211: ath9k: fix WiFi hang — chip is now automatically reset on inactivity
• mt76: mt76x02: fix WiFi traffic stall after interface reconfiguration
• procd: fix security issues (CVE-2026-30874) and other improvements
• umdns: fix security issues (CVE-2026-30871, CVE-2026-30872)

Core components update

• Linux kernel: update from 6.6.119 to 6.6.127
• openssl: update from 3.0.18 to 3.0.19
• procd: update from 2024-12-22 to 2026-03-14
• umdns: update from 2025-02-10 to 2026-02-06
• wireless-regdb: update from 2025.10.07 to 2026.02.04

OpenWrt 24.10 end of life

With the release of OpenWrt 25.12 stable series, the OpenWrt 24.10 stable series will go end of life in 6 months. We will not provide security updates for OpenWrt 24.10 after September 2026. We encourage everyone to upgrade to OpenWrt 25.12 before September 2026.

Upgrading to 24.10

Sysupgrade can be used to upgrade a device from 23.05 to 24.10, and configuration will be preserved in most cases.

For for upgrades inside the OpenWrt 24.10 stable series for example from a OpenWrt 24.10 release candidate Attended Sysupgrade is supported in addition which allows preserving the installed packages too.

• Sysupgrade from 22.03 to 24.10 is not officially supported.

• There is no configuration migration path for users of the ipq806x target for Qualcomm Atheros IPQ806X SoCs because it switched to DSA. You have to upgrade without saving the configuration. ''Image version mismatch. image 1.1 device 1.0 Please wipe config during upgrade (force required) or reinstall. Config cannot be migrated from swconfig to DSA Image check failed''

• User of the Linksys E8450 aka. Belkin RT3200 running OpenWrt 23.05 or earlier will need to run installer version v1.1.3 or later in order to reorganize the UBI layout for the 24.10 release. A detailed description is in the OpenWrt wiki. Updating without using the installer will break the device. Sysupgrade will show a warning before doing an incompatible upgrade.

• Users of the Xiaomi AX3200 aka. Redmi AX6S running OpenWrt 23.05 or earlier have to follow a special upgrade procedure described in the wiki. This will increase the flash memory available for OpenWrt. Updating without following the guide in the wiki break the device. Sysupgrade will show a warning before doing an incompatible upgrade.

• Users of Zyxel GS1900 series switches running OpenWrt 23.05 or earlier have to perform a new factory install with the initramfs image due to a changed partition layout. Sysupgrade will show a warning before doing an incompatible upgrade and is not possible. After upgrading, the config file /etc/config/system should not be restored from a backup, as this will overwrite the new compat_version value.

Known issues

• LEDs for Airoha AN8855 are not yet supported. Devices like the Xiaomi AX3000T with an Airoha switch will have their switch LEDs powered off. This issue will be addressed in an upcoming OpenWrt SNAPSHOT and the OpenWrt 24.10 minor release.
• 5GHz WiFi is non-functional on certain devices with ath10k chipsets. Affected models include the Phicomm K2T, TP-Link Archer C60 v3 and possibly others. For details, see issue #14541.

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/24.10/notes-24.10.6

In particular, make sure to read the regressions and known issues before upgrading: https://openwrt.org/releases/24.10/notes-24.10.6#known_issues

For a detailed list of all changes since 24.10.5, refer to https://openwrt.org/releases/24.10/changelog-24.10.6

To download the 24.10.6 images, navigate to: https://downloads.openwrt.org/releases/24.10.6/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=24.10.6

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the first stable release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org?version=25.12.0

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.0/targets/

Highlights in OpenWrt 25.12

OpenWrt 25.12.0 incorporates over 4700 commits since branching the previous OpenWrt 24.10 release and has been under development for over one year.

Only the main changes are listed below. See changelog-25.12.0 for the full changelog.

Honoring Dave Täht

OpenWrt 25.12 is named Dave's Guitar to honor Dave Täht, who sadly passed away on April 1, 2025.

Dave played a key role in reducing bufferbloat and improving network latency in OpenWrt and across the wider internet. His work made networks faster, more responsive, and more reliable for millions of users.

This release is dedicated to his memory and lasting impact on the networking community.

General changes

The hardware requirements did not change significantly. Most devices supported by OpenWrt 24.10 are also supported in OpenWrt 25.12.

Switch package manager from opkg to apk

OpenWrt has transitioned from the traditional opkg package manager to apk (Alpine Package Keeper).

This change brings several advantages:

• apk is still maintained; the OpenWrt opkg fork is no longer maintained.

apk supports most features of opkg. Only very few package names changed. The command line arguments of apk are different from the command line arguments of opkg.

For users migrating existing systems, an official opkg to apk cheatsheet is available to ease the transition and map common workflows.

Integration of attended sysupgrade

The attended sysupgrade LuCI application is now installed by default. owut is included by default in images for devices with larger flash storage.

ASU allows devices to:

• Upgrade to new OpenWrt firmware versions
• Automatically rebuild firmware images with all currently installed packages
• Preserve system configuration during upgrades
• ASU allows integrating additional installed packages directly into the SquashFS filesystem, which stores packages more efficiently than the overlay filesystem.

This dramatically simplifies upgrades: with just a few clicks in LuCI and a short wait, a custom firmware image is built and installed without manual intervention.

Shell history is preserved

Shell command history is now preserved across sessions by storing it in a RAM-backed filesystem.

Benefits:

• Command history is no longer lost between logins
• No unnecessary writes to flash storage by default

For users who prefer persistent history storage, this behavior can be changed by editing: ''/etc/profile.d/busybox-history-file.sh''

⚠️ Note: Storing history on flash will increase write cycles and may impact flash endurance over time.

Integration of video feed

The OpenWrt video feed with Qt5 and UI applications is integrated by default.

Wi-Fi scripts in ucode

The Wi-Fi scripts were rewritten in ucode. This is part of the rewrite of the management scripts from shell scripts to ucode.

uCode is used for system scripts because it is faster and safer than shell scripts, and integrates directly with ubus and UCI.

Wi-Fi and network management scripts rewritten in uCode run faster, have fewer errors, and are easier to maintain.

Target changes

• Extend the realtek target with support for more switch SoCs like 10G Ethernet switches.
• Extend the qualcommax target with support for ipq50xx and ipq60xx SoCs.
• Added the siflower target for Siflower SF21A6826/SF21H8898 SoCs
• Added the sunxi/arm926ejs subtarget for Allwinner F1C100/200s SoCs
• Added the microchipsw/lan969x target with support for Microchip LAN969x switches.

Many new devices added

OpenWrt 25.12 supports over 2200 devices. Support for over 180 new devices was added in addition to the devices already supported in OpenWrt 24.10. Most devices already supported by OpenWrt 24.10 are still supported.

Core components update

Core components have the following versions in 25.12.0:

• Updated toolchain:
  • musl libc 1.2.5
  • glibc 2.41
  • gcc 14.3.0
  • binutils 2.44
• Updated Linux kernel
  • 6.12.71 for all targets
• main packages:
  • cfg80211/mac80211 from kernel 6.18.7
  • hostapd master snapshot from August 2025
  • dnsmasq 2.91
  • dropbear 2025.89
  • busybox 1.37.0

In addition to the listed applications, many others were also updated.

OpenWrt 24.10 end of life

With the release of OpenWrt 25.12 stable series, the OpenWrt 24.10 stable series will go end of life in 6 months. We will not provide security updates for OpenWrt 24.10 after September 2026. We encourage everyone to upgrade to OpenWrt 25.12 before September 2026.

Upgrading to 25.12

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.

• Sysupgrade from 23.05 to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed.

• Bananapi BPI-R4: Interfaces ''eth1'' was renamed to ''sfp-lan'' or ''lan4'', and interface ''eth2'' was renamed to ''sfp-wan'' to match the labels. You have to upgrade without saving the configuration.

Scratch installs/upgrades

If you wish to start from scratch (always the safest, but also the most work), simply download the pre-built image from the downloads site or from the Firmware Selector to your device. Make sure to create and save a backup, then install the image using sysupgrade -n /tmp/firmware.bin or the LuCI Backup/Flash Firmware, being sure to set "Keep settings and retain the current configuration" to its off position. Restore or reconstruct your configuration using the contents of the backup as a template.

Attended Sysupgrade options

Attended Sysupgrade (ASU) allows you to build a custom image that retains all of your installed packages and their configuration transparently. You need to use one of the three ASU clients that interface with the ASU server to produce this custom image:

• Firmware Selector - an online builder that requires you to manually supply it with the packages you wish to have installed. This package list is sent to the ASU server, and a new custom device image is created containing those packages. You may then download and install the image in LuCI Backup/Flash Firmware, but for this you would enable "Keep settings..."
• Luci Attended Sysupgrade - the web interface to the ASU server. This tool allows you to choose a new OpenWrt version, then collects the names of the packages on your device and sends them up to the ASU server. LuCI ASU then downloads the created image directly to your device and allows you to install it, without having to do any of the bookkeeping tasks involved with using the Firmware Selector.
• owut - a command line package that does the same job as LuCI ASU, but provides more diagnostics and better visibility into what's happening at the various steps before and during the build process.

Both the LuCI ASU app and owut are optional packages in 24.10, so if you have not installed them, they won't be there by default. Use either the LuCI Package Manager to install them, or you can do it from the command line with opkg:

$ opkg update
$ opkg install luci-app-attendedsysupgrade
$ opkg install owut

Note that you can install one or the other, or both together, they are completely independent packages.

Upgrades with Firmware Selector

The Firmware Selector does an excellent job of searching through the thousands of available device configurations and getting you to the right place. But, some devices have several variants and possibly different image formats, so if you're unsure about which one you need or which device you're dealing with or anything else, go to the |Firmware Selector support thread and ask away.

Upgrades with LuCI Attended Sysupgrade

The LuCI web interface is fairly self-explanatory. If anything is unclear, please refer to the LuCI Attended Sysupgrade support thread for guidance.

Upgrades with owut

If you choose to use owut, the fact that it's a command line program means you'll need a little more explanation regarding best practices. In any situation, it's always safe to do a check to see what's going on.

$ owut check --verbose --version-to 25.12
... a lot of output ...

This check should show you all the details of what this upgrade entails with regards to the packages available, and will point out any issues with package versions and so on.

Assuming the results of the check look good, you can simply do an upgrade next.

$ owut upgrade --verbose --version-to 25.12
... even more output ...

If you are unsure of anything you see in the check, during the upgrade, or simply have questions, jump on over to the owut support thread on the forum and ask.

Known issues

• Users of Zyxel EX5601-T0 devices need to check their WAN interfaces as the port was renamed from eth1 to wan.
• Pixel 10 phones have problems connecting to WPA3 protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.0

In particular, make sure to read the regressions and known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.0#known_issues

For a detailed list of all changes since branching of 24.10, refer to https://openwrt.org/releases/25.12/changelog-25.12.0

To download the 25.12.0 images, navigate to: https://downloads.openwrt.org/releases/25.12.0/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.0

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

The OpenWrt community is proud to announce the fifth release candidate of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org?version=25.12.0-rc5

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.0-rc5/targets/

Please test this version

This is not the final version, this is a test version. Please report problems and bugs in our issue tracker.

Highlights in OpenWrt 25.12

OpenWrt 25.12.0-rc5 incorporates over 4600 commits since branching the previous OpenWrt 24.10 release and has been under development for over one year.

Only the main changes are listed below. See changelog-25.12.0-rc5 for the full changelog.

General changes

The hardware requirements did not change significantly, most devices supported by OpenWrt 24.10 should also work with OpenWrt 25.12.

Switch package manager from opkg to apk

OpenWrt has transitioned from the traditional opkg package manager to apk (Alpine Package Keeper).

This change brings several advantages:

• apk is still maintained, the OpenWrt opkg fork was not maintained any more.

apk supports most features of opkg. Only very few package names changed. The command line arguments of apk are different from the command line arguments of opkg.

For users migrating existing systems, an official opkg to apk cheatsheet is available to ease the transition and map common workflows.

Integration of attended sysupgrade

The attended sysupgrade LuCI application is now installed by default.

ASU allows devices to:

• Upgrade to new OpenWrt firmware versions
• Automatically rebuild firmware images with all currently installed packages
• Preserve system configuration during upgrades

This dramatically simplifies upgrades: with just a few clicks in LuCI and a short wait, a custom firmware image is built and installed without manual intervention.

Shell history is preserved

Shell command history is now preserved across sessions by storing it in a RAM-backed filesystem.

Benefits:

• Command history is no longer lost between logins
• No unnecessary writes to flash storage by default

For users who prefer persistent history storage, this behavior can be changed by editing: /etc/profile.d/busybox-history-file.sh

⚠️ Note: Storing history on flash will increase write cycles and may impact flash endurance over time.

Integration of video feed

The OpenWrt video feed with Qt5 and UI applications is integrated by default.

Wi-Fi scripts in ucode

The wifi scripts were rewritten in ucode.

Target changes

• Extend realtek target with support for more switch SoCs like 10G Ethernet switches.
• Extend qualcommax target with support for ipq50xx and ipq60xx SoCs.
• Added siflower target for Siflower SF21A6826/SF21H8898 SoCs
• Added sunxi/arm926ejs subtarget for Allwinner F1C100/200s SoCs

Many new devices added

OpenWrt 25.12 supports over 2240 devices. Support for over 220 new devices was added in addition to the device support by OpenWrt 24.10.

Core components update

Core components have the following versions in 25.12.0-rc5:

• Updated toolchain:
  • musl libc 1.2.5
  • glibc 2.41
  • gcc 14.3.0
  • binutils 2.44
• Updated Linux kernel
  • 6.12.71 for all targets
• main packages:
  • cfg80211/mac80211 from kernel 6.18.7
  • hostapd master snapshot from August 2025
  • dnsmasq 2.91
  • dropbear 2025.89
  • busybox 1.37.0

In addition to the listed applications, many others were also updated.

Upgrading to 25.12

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.

• Sysupgrade from 23.05 to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed.

• Bananapi BPI-R4: Interfaces eth1 was renamed to sfp-lan or lan4 and the interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration.

Scratch installs/upgrades

If you wish to start from scratch (always the safest, but also the most work), simply download the pre-built image from the downloads site or from the Firmware Selector to your device. Make sure to create and save a backup, then install the image using sysupgrade -n /tmp/firmware.bin or the LuCI Backup/Flash Firmware, being sure to set "Keep settings and retain the current configuration" to its off position. Restore or reconstruct your configuration using the contents of the backup as a template.

Attended Sysupgrade options

Attended Sysupgrade (ASU) allows you to build a custom image that retains all of your installed packages and their configuration transparently. You need to use one of the three ASU clients that interface with the ASU server to produce this custom image:

• Firmware Selector - an online builder that requires you to manually supply it with the packages you wish to have installed. This package list is sent to the ASU server, and a new custom device image is created containing those packages. You may then download and install the image in LuCI Backup/Flash Firmware, but for this you would enable "Keep settings..."
• Luci Attended Sysupgrade - the web interface to the ASU server. This tool allows you to choose a new OpenWrt version, then collects the names of the packages on your device and sends them up to the ASU server. LuCI ASU then downloads the created image directly to your device and allows you to install it, without having to do any of the bookkeeping tasks involved with using the Firmware Selector.
• owut - a command line package that does the same job as LuCI ASU, but provides more diagnostics and better visibility into what's happening at the various steps before and during the build process.

Both the LuCI ASU app and owut are optional packages in 24.10, so if you have not installed them, they won't be there by default. Use either the LuCI Package Manager to install them, or you can do it from the command line with opkg:

$ opkg update
$ opkg install luci-app-attendedsysupgrade
$ opkg install owut

Note that you can install one or the other, or both together, they are completely independent packages.

Upgrades with Firmware Selector

The Firmware Selector does an excellent job of searching through the thousands of available device configurations and getting you to the right place. But, some devices have several variants and possibly different image formats, so if you're unsure about which one you need or which device you're dealing with or anything else, go to the |Firmware Selector support thread and ask away.

Upgrades with LuCI Attended Sysupgrade

The LuCI web interface should be fairly self explanatory. Since you have fairly limited options there that should be pretty obvious, but if anything is unclear or you're unsure about something, go to the LuCI Attended Sysupgrade support thread and ask.

Upgrades with owut

If you choose to use owut, the fact that it's a command line program means you'll need a little more explanation regarding best practices. In any situation, it's always safe to do a check to see what's going on.

$ owut check --verbose --version-to 25.12
... a lot of output ...

This check should show you all the details of what this upgrade entails with regards to the packages available, and will point out any issues with package versions and so on.

Assuming the results of the check look good, you can simply do an upgrade next.

$ owut upgrade --verbose --version-to 25.12
... even more output ...

If you are unsure of anything you see in the check, during the upgrade, or simply have questions, jump on over to the owut support thread on the forum and ask.

Known issues

• Users of Zyxel EX5601-T0 devices need to check their WAN interfaces as port was renamed from eth1 to wan.

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.0-rc5

In particular, make sure to read the regressions and known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.0-rc5#known_issues

For a detailed list of all changes since 25.12.0-rc4, refer to https://openwrt.org/releases/25.12/changelog-25.12.0-rc5

To download the 25.12.0-rc5 images, navigate to: https://downloads.openwrt.org/releases/25.12.0-rc5/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.0-rc5

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact