The distribution release of OpenWrt 25.12.6 has been introduced, developed for network devices such as routers, switches, and access points. OpenWrt supports over 2200 devices and offers a build system that simplifies cross-compilation and the creation of custom builds. Such builds allow the formation of ready-made firmware with a desired set of pre-installed packages optimized for specific tasks. Ready-built images are published for 41 target platforms. <\/p>\n
New build options have been added for previously supported devices with Mediatek chips: Cudy M3000 v1\/v2 and Cudy M3000 v2 \u2014 images with U-Boot have been added.\n
Corrections related to platform operations have been made:\n
WPA3 settings have been modified to comply with the recommendations outlined in the WPA3 specification:\n
\n
By default, support for the GCMP-256 cipher and SAE-EXT-KEY key management algorithm is disabled in sae (WPA3-Personal) and sae-mixed (WPA2\/WPA3) modes.\n
When the Protected Management Frames (PMF \/ 802.11w) mode is active, the Beacon Protection mechanism is enabled by default, designed to safeguard against active attacks on the wireless network that manipulate beacon frame alterations.\n
A new compatibility mode with WPA3-Personal \u2014 sae-compat has been added, allowing WPA2 clients to continue using the WPA2 network while redirecting clients supporting RSN (Robust Security Network) to WPA3.\n
An option named transition_disable has been added to prevent clients from reverting to older security modes on a WPA3 network.\n<\/ul>\n
Support for 802.11ad (60 GHz) has been resumed in the wifi-scripts package, and the multicast_to_unicast option has been established.\n
The DHCP client has added the 'sendclientid' option to override the DHCPv4 and DHCPv6 client identifier.\n
A new optional theme has been proposed in the LuCI web interface, \n'luci-theme-footstrap'. The 'luci-mod-dashboard' theme has added interactive graphs and the ability to configure the layout of elements. New applications luci-app-librespeed and luci-app-weechat have been added.<\/p>\n
Updated versions of the Linux kernel 6.12.112 (previously 6.12.94), OpenSSL 3.5.9, \nMbed TLS 3.6.7, wolfSSL 5.9.4, mac80211 6.18.55, wireless-regdb 2026.09.03, nilfs-utils 2.2.17, wireguard-tools 1.0.20260223, uhttpd, rpcd, umdns, odhcp6c, and iwinfo.<\/p>\n
Updated versions of curl 8.22.0, OpenSSH 10.6p1, unbound 1.26.1, \nBIND 9.20.29, \nOpenVPN 2.7.7, strongSwan 6.0.7, HAProxy 3.2.21, expat 2.8.4, nghttp2 \n1.70.0, \nlibssh 0.12.2, c-ares 1.34.8, Tor 0.4.9.13, Knot DNS 3.5.7, PowerDNS 4.9.17, \nPowerDNS Recursor 5.2.13, Exim 4.100.1, Python 3.13.15, Node.js 22.23.2, \nxz 5.8.3, and rsync 3.5.1 with vulnerability fixes.<\/p>\n
Remote exploitable vulnerabilities in default-enabled network services have been addressed:\n
\n
uhttpd \u2014 buffer overflow through parameter manipulation in 'POST \/ubus\/call\/' requests, as well as several DoS vulnerabilities and the ability to inject into other requests.\n
16 vulnerabilities in Mbed TLS (used by default in uhttpd, hostapd, and wpa_supplicant), including a remote buffer overflow exploitable in (D)TLS configurations with the ECDHE-PSK cipher suite.\n
hostapd and wpa_supplicant \u2014 memory corruption when processing specially crafted control frames (attack possible without authentication) in WiFi 7 networks.\n
rpcd \u2014 two vulnerabilities leading to privilege escalation due to issues in handling symbolic links and \nplacing a privileged session token in a temporary directory.<\/p>\n
cgi-io \u2014 accessing memory after it has been freed when decoding specially crafted POST requests.\n
LuCI web interface: several vulnerabilities allowing an unprivileged user to execute code with root privileges.\n
ead-client (Emergency Access Daemon client): buffer overflow when processing specially crafted spoofed messages from server<\/a>.\n