What changed in OpenWrt from 24 to 25

Hi,

The OpenWrt community is proud to announce the fifth service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.5

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.5/targets/

Main changes between OpenWrt 25.12.4 and OpenWrt 25.12.5

Only the main changes are listed below. See the full changelog for details.

Security fixes

This release fixes several remotely triggerable vulnerabilities in core network services that are enabled by default. Updating is strongly recommended.

• odhcpd (DHCPv6/DHCPv4/RA server, enabled by default): multiple vulnerabilities reachable by a network-adjacent attacker were fixed by updating odhcpd:
  • CVE-2026-53921 (Critical): stack buffer overflow in the DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST packets. https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496
  • CVE-2026-53918 (High): use-after-free in the DHCPv6 IA handler. https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2
  • CVE-2026-53920 (High): stack memory disclosure via a truncated DHCPv6 IA_NA/IA_PD option. https://github.com/openwrt/odhcpd/security/advisories/GHSA-p769-5v73-pc4f
  • CVE-2026-53922 (Moderate): pre-auth denial of service via a size_t underflow in DHCPv6 IA handling. https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5
  • CVE-2026-55606 (Moderate): stack buffer overread caused by a DUID length endianness mismatch. https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45
  • No CVE assigned (Moderate, CVSS 5.4): the NDP relay accepted IPv6 Neighbor Solicitations with a hop limit other than 255 (RFC 4861 violation), letting an off-link attacker spoof NS packets through the relay (neighbor-cache poisoning, traffic redirection or DoS). Only relevant when the NDP relay is enabled. https://github.com/openwrt/odhcpd/security/advisories/GHSA-qvg7-9jf5-wgjc
• odhcpd / LuCI stored XSS (Critical): an unauthenticated DHCPv6 client could inject lease-file lines through a crafted FQDN hostname, resulting in stored cross-site scripting on the LuCI DHCPv6 leases status page. Fixed by escaping client hostnames in the lease state file. https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f
• uhttpd (web server): three HTTP request smuggling issues on keep-alive connections were fixed:
  • CVE-2026-55612 (High): invalid chunk-length state reset. https://github.com/openwrt/uhttpd/security/advisories/GHSA-p55c-rmhc-qfm5
  • CVE-2026-55614 (High): case-sensitive Transfer-Encoding matching. https://github.com/openwrt/uhttpd/security/advisories/GHSA-mcfg-c4r7-pjpf
  • CVE-2026-55613 (Moderate): ubus POST body parse-error desync. https://github.com/openwrt/uhttpd/security/advisories/GHSA-wgwp-64hh-f52p
• cgi-io: ACL bypass / arbitrary file read (Moderate): a path-traversal flaw in the cgi-download handler let an authenticated user with wildcard read permission read any root-readable file (e.g. /etc/shadow). https://github.com/openwrt/openwrt/security/advisories/GHSA-jw5r-xhf5-2xcq
• LuCI (web interface): a set of issues in LuCI core modules and applications were fixed. Most let a logged-in user with limited (delegated) permissions escalate to root command execution; a few are stored XSS issues reachable by clients on the network. The privilege-escalation issues only apply if the affected app is installed and the account/ACL in question exists:
  • luci-app-tailscale-community (Critical, CVSS 9.9): command injection allowing delegated users to run commands as root via tailscale.do_login. https://github.com/openwrt/luci/security/advisories/GHSA-xwc5-mx58-rh35
  • luci-app-advanced-reboot (High): CVE-2026-55897 — a read ACL exposes /bin/sh via file.exec, allowing delegated users to run commands as root. https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6
  • luci-app-adblock-fast (High): CVE-2026-55159 — delegated users can reach root command execution via newline-separated cron entries. https://github.com/openwrt/luci/security/advisories/GHSA-ggpf-xrph-wg5v
  • luci-app-samba4 (High): a read ACL allows authenticated root command execution via the smbd file.exec permission. https://github.com/openwrt/luci/security/advisories/GHSA-vx64-mmp7-h36c
  • luci-app-travelmate (High): a delegated UCI write can execute the travelmate auto-login command as root. https://github.com/openwrt/luci/security/advisories/GHSA-p35r-3323-6g7g
  • luci-app-upnp (High): stored XSS — an unauthenticated LAN client can inject JavaScript via a UPnP port-mapping description. https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89
  • luci-mod-network / luci-mod-status (High): stored XSS via a DHCPv6 lease hostname (FQDN) shown in the status tables. https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh
  • luci-app-banip (High): a crafted LuCI login username can inject an arbitrary IP into banIP's log parser, causing the wrong address to be blocked. https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m
• ead (Emergency Access Daemon): CVE-2026-55490 (Moderate): an integer underflow in handle_send_a() allowed a pre-auth denial of service. https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw
• Linux kernel: update to 6.12.94, pulling in the upstream 6.12.88 through 6.12.94 stable releases, which fix multiple security vulnerabilities, such as CVE-2026-43500.
• OpenSSL: update to 3.5.7, fixing multiple security vulnerabilities (CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447).
• musl libc: backport upstream fixes for CVE-2026-6042 and CVE-2026-40200.
• dropbear (SSH): backport security fixes from upstream 2026.90 and 2026.91, including CVE-2019-6111 (a malicious server could trick the scp client into overwriting arbitrary local files) and CVE-2026-35385.

Beyond the issues listed above, this release fixes a number of further security problems for which no CVE number or dedicated advisory was assigned. We strongly recommend upgrading to the latest OpenWrt release and installing all available package updates.

Device support

New devices supported in 25.12.5:

• ipq40xx: Linksys MR9000
• mediatek (filogic): GL.iNET GL-MT3600BE
• mediatek (filogic): Huasifei WH3000R (NAND)
• mediatek (filogic): JioRouter AX6000 (JIDU6101)
• mediatek (filogic): netis EAP930 V1
• mediatek (filogic): netis MEX605
• mediatek (filogic): TP-Link F65 v1
• mediatek (filogic): Zbtlink ZBT-Z8106AX-S
• mvebu: Zyxel NAS326
• ramips (mt76x8): Cudy WR300 v1
• ramips (mt7621): I-O DATA WN-AX2033GR2

New image variants for already supported devices:

• mediatek (filogic): Qihoo 360T7 - add UBI layout image
• mediatek (filogic): Creatlentem CLT-R30B1 - add all-in-UBI layout image
• mediatek (filogic): Bazis AX3000WM - also recognized under its alternative name WD-R3000N-G2A

Device fixes:

• ath79: MikroTik - build AG71XX_LEGACY as a module, fixing AR8216/AR8236/AR8316 switch bring-up on boot on some MikroTik devices (https://github.com/openwrt/openwrt/issues/23739)
• mediatek: do not let devfreq power off the CPU (stability fix)
• mediatek (filogic): Wavlink WL-WN536AX6 rev A - several fixes (correct 5 GHz MAC address, MAC-address nvmem layout, NAND bad-block management, SPI drive strength, network LED)
• mediatek (filogic): Qihoo 360T7 - fix DDR3 rate
• mediatek: Acer Predator W6X - add LED boot status support
• ramips: PAX1800 Lite - fix label MAC device and avoid attaching both UBI partitions on boot
• ramips (mt76x8): Cudy LT300 v3 - fix backup partition offset
• rtl8367b: fix RTL8367S-VB VLAN multicast memory handling
• mvebu: uDPU / eDPU - convert to dual (A/B) firmware
• ipq806x: AP3935 - disable hibernation on LAN1
• airoha (an7581): platform improvements and upstream networking fixes

WiFi fixes and improvements

• wifi-scripts: fix a null dereference on 6 GHz-only radios
• wifi-scripts: fix EAP (802.1X) station mode in the wpa_supplicant configuration generator
• wifi-scripts: fix tracking of disabled virtual interfaces
• hostapd: fix a misplaced radar-detected (DFS) ubus notification

Network and service improvements

• New "network" LED trigger (lan/wan/wlan) for link and activity indication on supported devices
• odhcpd and odhcp6c received many DHCPv6/DHCPv4 and IPv6 prefix-delegation correctness and robustness fixes, on top of the security fixes listed above, including more stable DHCPv6 IAID handling
• More robust handling of invalid DHCP / DHCPv6 client identifiers
• ubus, rpcd, uhttpd, umdns, uclient and fstools updated with stability and hardening fixes

Other changes

• kmod-nf-nathelper-extra was split into individual per-protocol packages, so only the needed NAT helper modules have to be installed.
• Matching the linker max-page-size to the target page size removes unnecessary padding, which can make many binaries - and thus the images - a bit smaller.
• OpenWrt builds are now more reproducible.

Core component updates

• Linux kernel: update from 6.12.87 to 6.12.94
• OpenSSL: update from 3.5.6 to 3.5.7 (multiple security fixes, see above)
• wireless-regdb: update from 2026.03.18 to 2026.05.30
• dnsmasq: update from 2.91 to 2.93
• ca-certificates: update from 20260223 to 20260601 (refreshed root CA bundle)
• util-linux: update from 2.41.3 to 2.41.5

Upgrading to 25.12.5

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts. For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. https://github.com/openwrt/openwrt/commit/fc0c518a88e68d3deef04bec73b33d35186d6546

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. https://github.com/openwrt/openwrt/commit/cd8dcfef378044a1687adfa3738f01f9a9622baf

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

• Meraki MX60: Direct sysupgrade to 25.12.5 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.

• Sitecom WLR-7100 (X7 AC1200): This device was moved from the ath79/generic target to the ath79/tiny target in OpenWrt 25.12.4. Users upgrading from 25.12.3 or earlier need to flash the new image from the ath79/tiny target (use sysupgrade -F).

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. https://github.com/openwrt/openwrt/issues/22344

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.5

In particular, make sure to read the known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.5#known_issues

For a detailed list of all changes, refer to https://openwrt.org/releases/25.12/changelog-25.12.5

To download the 25.12.5 images, navigate to: https://downloads.openwrt.org/releases/25.12.5/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.5

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the fourth service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.4

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.4/targets/

Main changes between OpenWrt 25.12.3 and OpenWrt 25.12.4

Only the main changes are listed below. See the full changelog for details.

Security fixes

• dnsmasq: backport six upstream CVE-fix patches to dnsmasq 2.91:
  • CVE-2026-2291: heap buffer overflow in DNS domain-name handling.
  • CVE-2026-4890 / CVE-2026-4891: DNSSEC crashes via crafted NSEC bitmaps / RRSIG packets.
  • CVE-2026-4892: buffer overflow on large DHCPv6 CLIDs (only with --dhcp-script).
  • CVE-2026-4893: broken EDNS Client Subnet validation.
  • CVE-2026-5172: buffer overflow in extract_addresses() on crafted resource records.
• Linux kernel: CVE-2026-43284 ("Dirty Frag") — local privilege escalation via the IPsec ESP path. Only relevant on devices with kmod-ipsec / esp4/esp6 loaded. Fixed via the 6.12.87 kernel update.

Device support

New devices supported in 25.12.4:

• ath79: MikroTik RouterBOARD 960PGS (hEX PoE / PowerBox Pro)
• mediatek: filogic: Cudy WR3000E v1: add ubootmod variant
• mediatek: filogic: Cudy WR3000H v1: add ubootmod variant
• mediatek: filogic: Cudy WR3000P v1: add ubootmod variant
• mediatek: filogic: Cudy WR3000S v1: add ubootmod variant

Device fixes:

• ath79: Sitecom WLR-7100 (X7 AC1200): fix MAC address assignment, wire up 5 GHz WLAN LED, and move to the tiny target to free ~800 KiB of flash
• ipq40xx: Pakedge WR-1: restore lost band label on the WLAN LEDs
• mediatek: filogic: Cudy WR3000E/H/P/S v1 and WBR3000UAX v1 (ubootmod NAND builds): disable NMBM, which was mistakenly enabled and prevented the NAND from being used correctly
• microchipsw: fix LAN8814 QSGMII soft reset

WiFi fixes and improvements

• wifi-scripts: fix basic_rate mapping in the wpa_supplicant ucode generator
• mac80211: update backports package to 6.18.26 (general stability improvements)

Core component updates

• Linux kernel: update from 6.12.85 to 6.12.87
• mac80211: update from 6.18.7 to 6.18.26

Upgrading to 25.12.4

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts. For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. https://github.com/openwrt/openwrt/commit/fc0c518a88e68d3deef04bec73b33d35186d6546

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. https://github.com/openwrt/openwrt/commit/cd8dcfef378044a1687adfa3738f01f9a9622baf

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

• Meraki MX60: Direct sysupgrade to 25.12.4 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. https://github.com/openwrt/openwrt/issues/22344

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.4

In particular, make sure to read the known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.4#known_issues

For a detailed list of all changes, refer to https://openwrt.org/releases/25.12/changelog-25.12.4

To download the 25.12.4 images, navigate to: https://downloads.openwrt.org/releases/25.12.4/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.4

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the third service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.3

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.3/targets/

Main changes between OpenWrt 25.12.2 and OpenWrt 25.12.3

Only the main changes are listed below. See the full changelog for details.

Security fixes

• Linux kernel: fixes CVE-2026-31431 ("Copy Fail"). In earlier releases this only affected users on the starfive target and users who had installed kmod-crypto-user.
• mbedtls: update to 3.6.6 (multiple CVE fixes)
• OpenSSL: update to 3.5.6 (multiple CVE fixes)
• wolfSSL: update to 5.9.1 (multiple CVE fixes)

Device support

New devices supported in 25.12.3:

• mediatek: filogic: ASUS RT-AX52 PRO
• mediatek: filogic: D-Link AQUILA PRO AI E30
• mediatek: filogic: Huasifei WH3000 Pro (NAND variant)
• mediatek: filogic: Keenetic KAP-630 / Netcraze NAP-630
• mediatek: filogic: Zbtlink ZBT-Z8106AX-T
• mediatek: filogic: Zyxel WX5600-T0
• ramips: mt7621: EDUP EP-RT2983
• ramips: mt76x8: Cudy LT300 v3
• x86: DFI ADN553
• x86: DFI ASL553

Device fixes:

• ath79: Netgear WNDAP360: multiple fixes restoring proper operation (sysupgrade, kernel loader, ethernet, LED, serial baud rate and U-Boot environment)
• ath79: Extreme Networks WS-AP3805i: fix U-Boot environment configuration
• ath79: Mikrotik: fix included device packages
• ipq50xx: Linksys MX5500: add label MAC device assignment
• lantiq: Netgear DGN3500: fix U-Boot environment size — device was broken on 25.12 (https://github.com/openwrt/openwrt/issues/22692)
• mediatek: filogic: Bananapi BPI-R4: add device tree overlay for the BE14 WiFi 7 module — fixes very low WiFi TX power on this module (https://github.com/openwrt/openwrt/issues/17489)
• mediatek: filogic: Keenetic KN-1812: various Ethernet PHY device tree fixes (PHY reset, interrupt support, MDIO drive strength, partition naming, xsphy node)
• mediatek: filogic: Netgear EAX17: fix rootfs hash in FIT node for per-device rootfs builds
• mediatek: filogic: CMCC RAX3000M: add Airoha AN8855 switch support (https://github.com/openwrt/openwrt/issues/21230)
• mediatek: filogic: Zbtlink ZBT-Z8103AX-D: enable NMBM on the SPI-NAND flash
• mvebu: ClearFog Base/Pro: fix switch kernel module
• qualcommax: ipq50xx: Xiaomi AX6000: enable PCIe1 for QCA9887
• qualcommax: ipq807x: Linksys MX5300: add label MAC assignment
• ramips: Yuncore CPE200: fix EEPROM size
• ramips: mt7621: fix reset hang
• ramips: Wavlink WL-WN575A3: fix EEPROM size for 5 GHz WiFi
• ramips: Xiaomi Mi Router 4C: fix WAN LED GPIO (https://github.com/openwrt/openwrt/issues/18578)

WiFi fixes and improvements

• wifi-scripts: fix incorrect erp_domain and fils_cache_id values generated by the ucode-based config script (https://github.com/openwrt/openwrt/issues/21768)
• wifi-scripts: add missing bridge_isolate and network_vlan fields to the ucode schema (https://github.com/openwrt/openwrt/issues/22620)
• wifi-scripts: add missing iface and other fields to the ucode station/vlan schema (https://github.com/openwrt/openwrt/issues/22165)
• wifi-scripts: add EHT (WiFi 7) rates to set_fixed_freq

Networking and system fixes

• mbedtls: backport upstream patches to fix TLS 1.2 client issues — fixes a regression that broke DDNS updates and other TLS 1.2 client connections; the regression was introduced in mbedtls package updates shipped after the 25.12.2 release (https://github.com/openwrt/openwrt/issues/22874)
• base-files: sysupgrade: fix -u option (skip default configuration) which was broken with apk
• base-files: sysupgrade: fix -f (custom backup) when the path contains spaces
• base-files: sysupgrade: update backup exclusion list
• base-files: use DISKSEQ instead of MAJOR/MINOR for stable disk identification (MAJOR/MINOR are not sequential)
• lantiq: fix mtdparsers refcount and memory leak
• uqmi / umbim: introduce devpath option for selecting cellular modems by USB device path
• kernel: add kmod-vsock and kmod-vsock-virtio for VM guests (vsock communication)

Core component updates

• Linux kernel: update from 6.12.74 to 6.12.85
• ca-certificates: update from 20250419 to 20260223
• linux-firmware: update from 20251125 to 20260221
• mbedtls: update from 3.6.5 to 3.6.6 (security fixes)
• OpenSSL: update from 3.5.5 to 3.5.6 (security fixes)
• wireless-regdb: update from 2026.02.04 to 2026.03.18
• wolfSSL: update from 5.8.4 to 5.9.1 (security fixes)
• xdp-tools: update from 1.4.3 to 1.6.3

Upgrading to 25.12.3

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts. For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. https://github.com/openwrt/openwrt/commit/fc0c518a88e68d3deef04bec73b33d35186d6546

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. https://github.com/openwrt/openwrt/commit/cd8dcfef378044a1687adfa3738f01f9a9622baf

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

• Meraki MX60: Direct sysupgrade to 25.12.3 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. https://github.com/openwrt/openwrt/issues/22344

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.3

In particular, make sure to read the known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.3#known_issues

For a detailed list of all changes, refer to https://openwrt.org/releases/25.12/changelog-25.12.3

To download the 25.12.3 images, navigate to: https://downloads.openwrt.org/releases/25.12.3/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.3

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the second service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.2

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.2/targets/

Main changes between OpenWrt 25.12.1 and OpenWrt 25.12.2

Only the main changes are listed below. See the full changelog for details.

Device support

• airoha: rename kernel module kmod-pwm-an7581 to kmod-pwm-airoha — users with this module explicitly installed need to reinstall under the new name
• apm821xx: fix U-Boot environment definitions for NETGEAR WNDR4700, Western Digital MyBookLive, Meraki MR24 and Meraki MX60; fix PCIe boot failure on Meraki MX60
• ath79: fix initramfs boot for Huawei AP5030DN and AP6010DN
• ath79: fix VLAN CPU port tagging on 2-CPU-port devices (affects several dual-CPU switch configurations)
• ath79: remove incorrectly included WiFi packages from Mikrotik RB750r2 (device has no WiFi hardware)
• ipq40xx: fix ART partition name for Linksys Velop WHW03 V1 — restores correct WiFi calibration data access
• ipq40xx: fix MAC address reading for Linksys devices using eMMC-based NVMEM
• lantiq: xrx200: fix failsafe mode on BT HomeHub 5A — LAN ports 1 & 2 now work correctly in failsafe (https://github.com/openwrt/openwrt/issues/22480)
• mediatek: Bananapi BPI-R4: fix SFP+ electric module support — modules that stopped working after a snapshot upgrade are now functional again (https://github.com/openwrt/openwrt/issues/19878)
• ramips: fix kernel decompress error that bricked ELECOM WRC-X1800GS on 25.12.0 (https://github.com/openwrt/openwrt/issues/22270)
• ramips: fix initramfs kernel load address for TP-Link EAP615-Wall v1
• ramips: fix MAC address assignment for Xiaomi Mi AC2100
• realtek: fix D-Link fan control script

WiFi fixes and improvements

• wifi-scripts: fix 160 MHz channel width configuration — hostapd was not correctly configured for 160 MHz, preventing its use (https://github.com/openwrt/openwrt/issues/22481)
• wifi-scripts: fix SU beamformee antenna count — incorrect count was passed to the driver
• hostapd: fix memory leak in Radio Resource Management (RRM) ubus interface
• mac80211: ath12k: add thermal sensor support for QCA/IPQ devices
• mac80211: ath9k: fix GPIO mask handling from device tree
• mt76: fix severe WiFi latency regression (up to multiple seconds) on 2.4 GHz introduced in 25.12.1 — affected many MediaTek devices including OpenWrt One, Zyxel EX5601, ASUS RT-AX53U, Xiaomi AX3000T/AX6000, Cudy WR3000/X6, GL Flint 2 and others (https://github.com/openwrt/openwrt/issues/22491)
• mt76: multiple further stability fixes for MediaTek WiFi chipsets (MT7615/MT7915/MT7996/MT7992/MT792x):
  • add per-link beacon monitoring for MLO (Multi-Link Operation)
  • fix MT7996/MT7992 link handling during MLO station add/remove
  • fix scan work requeue race with spinlock

Upgrading to 25.12.2

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts. For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. https://github.com/openwrt/openwrt/commit/fc0c518a88e68d3deef04bec73b33d35186d6546

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. https://github.com/openwrt/openwrt/commit/cd8dcfef378044a1687adfa3738f01f9a9622baf

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

• Meraki MX60: Direct sysupgrade to 25.12.2 is not possible without manual preparation — meraki_loadaddr must be changed before upgrading, as the default value is insufficient to boot OpenWrt 25.12+. See the device wiki page for instructions.

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. https://github.com/openwrt/openwrt/issues/22344

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.2

In particular, make sure to read the known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.2#known_issues

For a detailed list of all changes, refer to https://openwrt.org/releases/25.12/changelog-25.12.2

To download the 25.12.2 images, navigate to: https://downloads.openwrt.org/releases/25.12.2/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.2

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the first service release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org/?version=25.12.1

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.1/targets/

Main changes between OpenWrt 25.12.0 and OpenWrt 25.12.1

Only the main changes are listed below. See the full changelog for details.

Security fixes

OpenWrt components (Trail of Bits audit, February 2026):

• CVE-2026-30871: Stack buffer overflow in umdns DNS PTR query handling (HIGH)
• CVE-2026-30872: Stack buffer overflow in umdns IPv6 reverse DNS lookup (HIGH)
• CVE-2026-30873: Memory leak in jsonpath when processing strings, labels, and regexp tokens (LOW)
• CVE-2026-30874: Command execution via PATH environment variable filter bypass in procd (LOW)

LuCI:

• CVE-2026-32721: Possible XSS attack via malicious SSID in LuCI WiFi scan modal (HIGH)

Additional hardening from the same Trail of Bits audit (no CVE assigned):

• odhcpd: fix stack buffer overflow in DHCPv6 Identity Association logging
• procd: fix out-of-bounds write in cgroup path building and cgroup rule application

Device support

• airoha: fix EN7581 PCIe initialization and add x2 (2-lane) link support — improves PCIe reliability and unlocks full bandwidth for affected devices
• ath79: TP-Link RE355 v1, RE450 v1/v2: fix partition alignment to prevent configuration loss on sysupgrade
• ipq40xx: Devolo Magic 2 WiFi next: enable device support
• ipq40xx: re-enable MeshPoint.One target
• ipq806x: AP3935: fix U-Boot NVMEM layout
• lantiq: fix GPIO expander clock (gpio-stp-xway) — restores correct LED and GPIO behaviour on affected devices
• lantiq: fix missing WAN MAC address assignment on some devices
• mediatek: Cudy M3000: add support for hardware variant with Motorcomm YT8821 PHY (previously only the Realtek PHY variant was supported)
• mediatek: TP-Link BE450: fix 10GbE PHY reset timing that caused intermittent boot stalls, add missing WLAN toggle button, fix reported memory size
• microchipsw: Novarq Tactical 1000: fix swapped SFP I2C buses for ports 1 and 3 — fixes SFP EEPROM read failures
• ramips: Keenetic KN-1910: fix sysupgrade functionality
• realtek: RTL838x-based switches: fix non-functional reboot
• treewide: Linksys devices: fix MAC address assignment

WiFi fixes and improvements

• mac80211: fix crash triggered by Channel Switch Announcement (CSA) when AP VLAN interfaces are in use
• mt76: add MT7990 firmware support (new MediaTek WiFi 7 chipset)
• mt76: mt7915: fix power save mode handling
• mt76: mt7921/MT7902: add MT7902e MCU and DMA layout support
• mt76: mt7996/mt7992: fix crash in transmit path, fix out-of-bounds access during hardware restart, improve MLO/CSA and radar detection support
• wifi-scripts: fix incorrect VHT160 capability advertisement — was incorrectly set on non-160 MHz AP configurations, degrading station upload speed (https://github.com/openwrt/openwrt/issues/22435)
• wifi-scripts: fix malformed wpa_supplicant config when 802.1X EAP credentials (identity, password, certificates) contain spaces (https://github.com/openwrt/openwrt/issues/22212)

Web interface (LuCI) and system fixes

• luci-mod-network: fix XSS vulnerability in WiFi scan modal (CVE-2026-32721)
• ustream-ssl (OpenSSL variant): fix use-after-free crash causing uhttpd (the LuCI web server) to crash under high load (https://github.com/openwrt/openwrt/issues/19349)

Networking and system fixes

• firewall4: set as the preferred firewall package over the legacy firewall package
• iptables: prefer the nftables-backed variants (iptables-nft, ip6tables-nft) when iptables is pulled in as a dependency
• kernel: CAKE QoS scheduler fixes — avoid unnecessary synchronization overhead when running without a rate limit, fix DiffServ rate scaling
• kernel: SFP: improve Huawei MA5671a module support — module is now accessible even when no fiber is connected
• odhcpd: fix segfault when disabling a DHCP interface, fix DHCPv4 lease tree corruption, fix truncated field in DHCPv6 lease queries, fix DNS search list padding
• ppp: fix potential memory safety issue (undefined behavior in memcpy with overlapping buffers); remove the MRU limit patch for PPPoE connections (https://github.com/ppp-project/ppp/pull/573)

Package manager (apk)

• apk: update to version 3.0.5 with several OpenWrt-specific bug fixes
• apk: add --force-reinstall option to reinstall already-installed packages without requiring a version change

Core component updates

• apk: update from 3.0.2 to 3.0.5
• jsonfilter: update from 2025-10-04 to 2026-03-16 (fixes CVE-2026-30873)
• libubox: update from 2026-02-13 to 2026-03-13 (ABI version stabilized for 25.12 stable series)
• Linux kernel: update from 6.12.71 to 6.12.74
• odhcpd: update from 2026-01-19 to 2026-03-16
• omcproxy: update from 2025-10-04 to 2026-03-07
• procd: update from 2026-02-20 to 2026-03-14 (fixes CVE-2026-30874)
• umdns: update from 2025-10-04 to 2026-02-06 (fixes CVE-2026-30871, CVE-2026-30872)
• ustream-ssl: update from 2025-10-03 to 2026-03-01

Upgrading to 25.12.1

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts. For upgrades within the OpenWrt 25.12 stable series, Attended Sysupgrade is also supported, which allows preserving the installed packages.

• Sysupgrade from 23.05 or earlier to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed. https://github.com/openwrt/openwrt/commit/fc0c518a88e68d3deef04bec73b33d35186d6546

• Bananapi BPI-R4: Interface eth1 was renamed to sfp-lan or lan4, and interface eth2 was renamed to sfp-wan to match the labels. You have to upgrade without saving the configuration. https://github.com/openwrt/openwrt/commit/cd8dcfef378044a1687adfa3738f01f9a9622baf

• TP-Link RE355 v1, RE450 v1 and RE450 v2: The partition layout and block size changed in this release to fix configuration loss on sysupgrade. Users upgrading from OpenWrt 25.12.0 or earlier must use sysupgrade -F to force the upgrade. The image must not exceed 5.875 MB (6016 KiB).

Known issues

• Zyxel EX5601-T0: the WAN interface was renamed from eth1 to wan — check and update your network configuration after upgrading.
• Pixel 10 phones have problems connecting to WPA3-protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes connection problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200
• SQM CAKE MQ (cake_mq): throughput may be unexpectedly low on some configurations after the scheduler fixes in this release. https://github.com/openwrt/openwrt/issues/22344
• 160 MHz channel width cannot be configured. https://github.com/openwrt/openwrt/issues/22481

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.1

In particular, make sure to read the known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.1#known_issues

For a detailed list of all changes, refer to https://openwrt.org/releases/25.12/changelog-25.12.1

To download the 25.12.1 images, navigate to: https://downloads.openwrt.org/releases/25.12.1/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.1

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact

Hi,

The OpenWrt community is proud to announce the first stable release of the OpenWrt 25.12 stable series.

Download firmware images using the OpenWrt Firmware Selector:

• https://firmware-selector.openwrt.org?version=25.12.0

Download firmware images directly from our download servers:

• https://downloads.openwrt.org/releases/25.12.0/targets/

Highlights in OpenWrt 25.12

OpenWrt 25.12.0 incorporates over 4700 commits since branching the previous OpenWrt 24.10 release and has been under development for over one year.

Only the main changes are listed below. See changelog-25.12.0 for the full changelog.

Honoring Dave Täht

OpenWrt 25.12 is named Dave's Guitar to honor Dave Täht, who sadly passed away on April 1, 2025.

Dave played a key role in reducing bufferbloat and improving network latency in OpenWrt and across the wider internet. His work made networks faster, more responsive, and more reliable for millions of users.

This release is dedicated to his memory and lasting impact on the networking community.

General changes

The hardware requirements did not change significantly. Most devices supported by OpenWrt 24.10 are also supported in OpenWrt 25.12.

Switch package manager from opkg to apk

OpenWrt has transitioned from the traditional opkg package manager to apk (Alpine Package Keeper).

This change brings several advantages:

• apk is still maintained; the OpenWrt opkg fork is no longer maintained.

apk supports most features of opkg. Only very few package names changed. The command line arguments of apk are different from the command line arguments of opkg.

For users migrating existing systems, an official opkg to apk cheatsheet is available to ease the transition and map common workflows.

Integration of attended sysupgrade

The attended sysupgrade LuCI application is now installed by default. owut is included by default in images for devices with larger flash storage.

ASU allows devices to:

• Upgrade to new OpenWrt firmware versions
• Automatically rebuild firmware images with all currently installed packages
• Preserve system configuration during upgrades
• ASU allows integrating additional installed packages directly into the SquashFS filesystem, which stores packages more efficiently than the overlay filesystem.

This dramatically simplifies upgrades: with just a few clicks in LuCI and a short wait, a custom firmware image is built and installed without manual intervention.

Shell history is preserved

Shell command history is now preserved across sessions by storing it in a RAM-backed filesystem.

Benefits:

• Command history is no longer lost between logins
• No unnecessary writes to flash storage by default

For users who prefer persistent history storage, this behavior can be changed by editing: ''/etc/profile.d/busybox-history-file.sh''

⚠️ Note: Storing history on flash will increase write cycles and may impact flash endurance over time.

Integration of video feed

The OpenWrt video feed with Qt5 and UI applications is integrated by default.

Wi-Fi scripts in ucode

The Wi-Fi scripts were rewritten in ucode. This is part of the rewrite of the management scripts from shell scripts to ucode.

uCode is used for system scripts because it is faster and safer than shell scripts, and integrates directly with ubus and UCI.

Wi-Fi and network management scripts rewritten in uCode run faster, have fewer errors, and are easier to maintain.

Target changes

• Extend the realtek target with support for more switch SoCs like 10G Ethernet switches.
• Extend the qualcommax target with support for ipq50xx and ipq60xx SoCs.
• Added the siflower target for Siflower SF21A6826/SF21H8898 SoCs
• Added the sunxi/arm926ejs subtarget for Allwinner F1C100/200s SoCs
• Added the microchipsw/lan969x target with support for Microchip LAN969x switches.

Many new devices added

OpenWrt 25.12 supports over 2200 devices. Support for over 180 new devices was added in addition to the devices already supported in OpenWrt 24.10. Most devices already supported by OpenWrt 24.10 are still supported.

Core components update

Core components have the following versions in 25.12.0:

• Updated toolchain:
  • musl libc 1.2.5
  • glibc 2.41
  • gcc 14.3.0
  • binutils 2.44
• Updated Linux kernel
  • 6.12.71 for all targets
• main packages:
  • cfg80211/mac80211 from kernel 6.18.7
  • hostapd master snapshot from August 2025
  • dnsmasq 2.91
  • dropbear 2025.89
  • busybox 1.37.0

In addition to the listed applications, many others were also updated.

OpenWrt 24.10 end of life

With the release of OpenWrt 25.12 stable series, the OpenWrt 24.10 stable series will go end of life in 6 months. We will not provide security updates for OpenWrt 24.10 after September 2026. We encourage everyone to upgrade to OpenWrt 25.12 before September 2026.

Upgrading to 25.12

Upgrading from 24.10 to 25.12 should be transparent on most devices, as most configuration data has either remained the same or will be translated correctly on first boot by the package init scripts.

• Sysupgrade from 23.05 to 25.12 is not officially supported.

• Cron log level was fixed in busybox. system.@system[0].cronloglevel should be set to 7 for normal logging. 7 is the default now. If this option is not set, the default is used and no manual action is needed.

• Bananapi BPI-R4: Interfaces ''eth1'' was renamed to ''sfp-lan'' or ''lan4'', and interface ''eth2'' was renamed to ''sfp-wan'' to match the labels. You have to upgrade without saving the configuration.

Scratch installs/upgrades

If you wish to start from scratch (always the safest, but also the most work), simply download the pre-built image from the downloads site or from the Firmware Selector to your device. Make sure to create and save a backup, then install the image using sysupgrade -n /tmp/firmware.bin or the LuCI Backup/Flash Firmware, being sure to set "Keep settings and retain the current configuration" to its off position. Restore or reconstruct your configuration using the contents of the backup as a template.

Attended Sysupgrade options

Attended Sysupgrade (ASU) allows you to build a custom image that retains all of your installed packages and their configuration transparently. You need to use one of the three ASU clients that interface with the ASU server to produce this custom image:

• Firmware Selector - an online builder that requires you to manually supply it with the packages you wish to have installed. This package list is sent to the ASU server, and a new custom device image is created containing those packages. You may then download and install the image in LuCI Backup/Flash Firmware, but for this you would enable "Keep settings..."
• Luci Attended Sysupgrade - the web interface to the ASU server. This tool allows you to choose a new OpenWrt version, then collects the names of the packages on your device and sends them up to the ASU server. LuCI ASU then downloads the created image directly to your device and allows you to install it, without having to do any of the bookkeeping tasks involved with using the Firmware Selector.
• owut - a command line package that does the same job as LuCI ASU, but provides more diagnostics and better visibility into what's happening at the various steps before and during the build process.

Both the LuCI ASU app and owut are optional packages in 24.10, so if you have not installed them, they won't be there by default. Use either the LuCI Package Manager to install them, or you can do it from the command line with opkg:

$ opkg update
$ opkg install luci-app-attendedsysupgrade
$ opkg install owut

Note that you can install one or the other, or both together, they are completely independent packages.

Upgrades with Firmware Selector

The Firmware Selector does an excellent job of searching through the thousands of available device configurations and getting you to the right place. But, some devices have several variants and possibly different image formats, so if you're unsure about which one you need or which device you're dealing with or anything else, go to the |Firmware Selector support thread and ask away.

Upgrades with LuCI Attended Sysupgrade

The LuCI web interface is fairly self-explanatory. If anything is unclear, please refer to the LuCI Attended Sysupgrade support thread for guidance.

Upgrades with owut

If you choose to use owut, the fact that it's a command line program means you'll need a little more explanation regarding best practices. In any situation, it's always safe to do a check to see what's going on.

$ owut check --verbose --version-to 25.12
... a lot of output ...

This check should show you all the details of what this upgrade entails with regards to the packages available, and will point out any issues with package versions and so on.

Assuming the results of the check look good, you can simply do an upgrade next.

$ owut upgrade --verbose --version-to 25.12
... even more output ...

If you are unsure of anything you see in the check, during the upgrade, or simply have questions, jump on over to the owut support thread on the forum and ask.

Known issues

• Users of Zyxel EX5601-T0 devices need to check their WAN interfaces as the port was renamed from eth1 to wan.
• Pixel 10 phones have problems connecting to WPA3 protected WiFi 6 APs. https://github.com/openwrt/openwrt/issues/21486
• 802.11r Fast Transition (FT) causes problems with some WiFi clients when WPA3 is used. https://github.com/openwrt/openwrt/issues/22200

---

Full release notes and upgrade instructions are available at https://openwrt.org/releases/25.12/notes-25.12.0

In particular, make sure to read the regressions and known issues before upgrading: https://openwrt.org/releases/25.12/notes-25.12.0#known_issues

For a detailed list of all changes since branching of 24.10, refer to https://openwrt.org/releases/25.12/changelog-25.12.0

To download the 25.12.0 images, navigate to: https://downloads.openwrt.org/releases/25.12.0/targets/ Use OpenWrt Firmware Selector to download: https://firmware-selector.openwrt.org?version=25.12.0

As always, a big thank you goes to all our active package maintainers, testers, documenters and supporters.

Have fun!

The OpenWrt Community

---

To stay informed of new OpenWrt releases and security advisories, there are new channels available:

• a low-volume mailing list for important announcements: https://lists.openwrt.org/mailman/listinfo/openwrt-announce

• a dedicated "announcements" section in the forum: https://forum.openwrt.org/c/announcements/14

• other announcement channels (such as RSS feeds) might be added in the future, they will be listed at https://openwrt.org/contact