The distribution release of OpenWrt 25.12.6 has been introduced, developed for network devices such as routers, switches, and access points. OpenWrt supports over 2200 devices and offers a build system that simplifies cross-compilation and the creation of custom builds. Such builds allow the formation of ready-made firmware with a desired set of pre-installed packages optimized for specific tasks. Ready-built images are published for 41 target platforms.
Among the changes:
- Added support for devices:
- ipq806x: Aruba AP-324, AP-325, Siemens Scalance W1750D.
- mediatek: Airtel AirFiber AAP4221ZY, Zyxel EX3310-T0, Cudy WR3000U v1, Globitel BT-R320, Hiveton H5000M, Airpi H5000M, JioRouter AX6000 JIDU6J01 / JIDU6201, Livinet Li320, netis N6 V2, Teralink TL3020 (256 MB), WAVLINK WL-WNT100X3.
- qualcommax (ipq50xx): CMCC MR3000D-CI.
- ramips (mt7621): TP-Link ER605 v1 (TL-R605 v1).
- ramips (mt76x8): Cudy LT500 Outdoor v1.
- rockchip: FriendlyARM NanoPi R2S Plus.
- New build options have been added for previously supported devices using mediatek chips: Cudy M3000 v1/v2 and Cudy M3000 v2 — U-Boot images have been added.
- Corrections related to platform operations have been made:
- ath79: GL.iNet GL-E750 (Mudi) V2.
- bcm47xx: Gateworks Ventana, Traverse Ten64.
- mediatek: MT7986, Cudy, JioRouter AX6000 JIDU6101, Keenetic / Netcraze, Comfast CF-WR632AX, Cudy WR3000S, ipTIME AX3000SE, ipTIME A8004T.
- mpc85xx: Freescale P2020RDB, TP-Link TL-WDR4900 v1, Enterasys WS-AP3715i.
- mvebu: Turris MOX.
- qualcommax: ASUS RT-AX89X.
- realtek: D-Link DGS-1210-28P/MP.
- rockchip: NanoPi R3S (1 GB).
- sunxi: NanoPi NEO 2.
- WPA3 settings have been modified to comply with the recommendations outlined in the WPA3 specification:
- By default, support for the GCMP-256 cipher and SAE-EXT-KEY key management algorithm is disabled in sae (WPA3-Personal) and sae-mixed (WPA2/WPA3) modes.
- When the Protected Management Frames (PMF / 802.11w) mode is active, the Beacon Protection mechanism is enabled by default, designed to safeguard against active attacks on the wireless network that manipulate beacon frame alterations.
- A new compatibility mode has been added for WPA3-Personal — sae-compat, allowing WPA2 clients to continue using the WPA2 network while redirecting RSN (Robust Security Network) capable clients to WPA3.
- An option named transition_disable has been added to prevent clients from reverting to older security modes on a WPA3 network.
- Support for 802.11ad (60 GHz) has been resumed in the wifi-scripts package, and the multicast_to_unicast option has been established.
- In the DHCP client, the 'sendclientid' option has been added to override the DHCPv4 and DHCPv6 client identifier.
- A new optional theme has been proposed in the LuCI web interface,
‘luci-theme-footstrap’. Interactive graphics and the ability to customize element placement have been added to the ‘luci-mod-dashboard’ theme. New applications luci-app-librespeed and luci-app-weechat have been introduced. - Updated versions of the Linux kernel 6.12.112 (previously 6.12.94), OpenSSL 3.5.9,
Mbed TLS 3.6.7, wolfSSL 5.9.4, mac80211 6.18.55, wireless-regdb 2026.09.03, nilfs-utils 2.2.17, wireguard-tools 1.0.20260223, uhttpd, rpcd, umdns, odhcp6c, and iwinfo. - Updated versions of curl 8.22.0, OpenSSH 10.6p1, unbound 1.26.1,
BIND 9.20.29,
OpenVPN 2.7.7, strongSwan 6.0.7, HAProxy 3.2.21, expat 2.8.4, nghttp2
1.70.0,
libssh 0.12.2, c-ares 1.34.8, Tor 0.4.9.13, Knot DNS 3.5.7, PowerDNS 4.9.17,
PowerDNS Recursor 5.2.13, Exim 4.100.1, Python 3.13.15, Node.js 22.23.2,
xz 5.8.3, and rsync 3.5.1 with vulnerability fixes. - Remote exploitable vulnerabilities in default-enabled network services have been addressed:
- uhttpd — buffer overflow through parameter manipulation in requests "POST /ubus/call/", as well as several DoS vulnerabilities and potential injection into other requests.
- 16 vulnerabilities in Mbed TLS (used by default in uhttpd, hostapd, and wpa_supplicant), including a remote buffer overflow exploitable in (D)TLS configurations with the ECDHE-PSK cipher suite.
- hostapd and wpa_supplicant — memory corruption when processing specially crafted management frames (attack possible without authentication) in WiFi 7 networks.
- rpcd — two vulnerabilities leading to privilege escalation due to issues in handling symbolic links and
placing a privileged session token in a temporary directory. - cgi-io — access to freed memory when decoding specially crafted POST requests.
- LuCI web interface: several vulnerabilities allowing an unprivileged user to execute code with root privileges.
- ead-client (Emergency Access Daemon client): buffer overflow when processing specially crafted spoofed messages from server.
- dozens of vulnerabilities in OpenSSL and wolfSSL.
Source: opennet.ru
