Six unauthenticated vulnerabilities in uhttpd, the web server that ships enabled by default on every OpenWrt installation running LuCI, headline the 25.12.6 service release published today. The flaws range from memory-exhaustion denial of service (CVE-2026-102338) to an out-of-bounds write triggered by a malformed POST request and an HTTP request smuggling vector, all reachable without authentication. The release also bumps Mbed TLS to 3.6.7, closing a remote buffer overflow in ECDHE-PSK cipher suites, and pulls in OpenSSL 3.5.9 and wolfSSL 5.9.4 with dozens of additional CVE fixes between them. The Linux kernel moves from 6.12.94 to 6.12.112, absorbing 18 stable point releases worth of upstream security and stability patches. Anyone exposing LuCI to a network, even a trusted LAN, should treat this as an urgent update.
The other headline change affects every WPA3 access point. OpenWrt 25.12.0 through 25.12.5 offered GCMP-256 and SAE-EXT-KEY by default on WiFi 6 and WiFi 7 networks, but testing revealed that roughly 15% of client devices choke on that configuration, including Nanoleaf smart home gear, certain Motorola phones, Linux laptops running iwd, and Samsung tablets with 802.11r fast transition enabled. Starting with 25.12.6, only CCMP and plain SAE are offered by default. A new WPA3-Personal Compatibility Mode (sae-compat) lets WPA2 clients see a normal WPA2 network while WPA3-capable devices negotiate RSN overriding. Power users who need GCMP-256 or SAE-EXT-KEY can re-enable them per interface through LuCI or UCI, but the defaults now prioritize broad client compatibility. Separately, hostapd picks up fixes from security advisory 2026-1 for missing validation in WiFi 7 multi-link (MLO) management frames, where unauthenticated crafted frames could crash the daemon or corrupt memory.
On the hardware side, 25.12.6 adds first-class support for 14 new devices, leaning heavily on MediaTek Filogic with additions like the Cudy WR3000U v1, WAVLINK WL-WNT100X3, and JioRouter AX6000. The FriendlyARM NanoPi R2S Plus joins the rockchip target, and the TP-Link ER605 v1 wired router gains support on the ramips/mt7621 platform. Existing device owners benefit too: the NanoPi R3S gets a PCIe link fix for its RTL8111H Ethernet, Allwinner H5 boards like the NanoPi NEO 2 regain working USB, and MT7986-based routers (including the GL.iNet GL-MT6000) get a corrected system timer that eliminates persistent clock drift. The mac80211 wireless stack jumps to 6.18.55 with upstream fixes spanning ath10k, ath11k, iwlwifi, and rtw88 drivers.
A quieter but practical addition is the new sendclientid option for the DHCP client. Since 25.12.0, OpenWrt identifies itself to DHCP servers using a UUID-based DUID per RFC 4361, which broke connectivity with some ISP DHCP servers that expect a MAC-based identifier. The new per-interface toggle lets users fall back to hardware-address identification or suppress the client ID entirely, matching the behavior of OpenWrt 24.10. The option is accessible through LuCI under each interface's Advanced Settings tab or via UCI on the command line.
Firmware images are available now through the OpenWrt Firmware Selector and the project's download servers. Within-series upgrades from 25.12.x support Attended Sysupgrade with package preservation. Users on bcm53xx NAND devices should note that the upgrade to 25.12.6 will lose configuration one final time due to the fix landing in the flashing firmware itself. Full release notes and known issues are documented on the OpenWrt wiki.
