Release Notes

Release Notes

Firmware and portal updates for the Loxada managed router platform - new features, fixes, and security patches, all in one place.

FIRMWARE 6 June 2026

24.10.7

Upgrade to core OpenWRT 24.10.7. Fixes Linux kernel "Dirty Frag" privilege escalation and multiple dnsmasq vulnerabilities.

Security Fixed Linux kernel "Dirty Frag" local privilege escalation via the IPsec ESP path
Kernel CVE Fixes
CVE-2026-43284 HIGH Linux kernel (IPsec ESP)
Security Backported multiple upstream dnsmasq CVE fixes
dnsmasq CVE Fixes
CVE-2026-2291 HIGH dnsmasq
CVE-2026-4890 MEDIUM dnsmasq
CVE-2026-4891 MEDIUM dnsmasq
CVE-2026-4892 MEDIUM dnsmasq
CVE-2026-4893 MEDIUM dnsmasq
CVE-2026-5172 MEDIUM dnsmasq
FIRMWARE 23 May 2026

25.12.4

Upgrade to core OpenWRT 25.12.4. Fixes Linux kernel "Dirty Frag" privilege escalation and backports six dnsmasq CVE fixes.

Security Fixed Linux kernel "Dirty Frag" local privilege escalation via IPsec ESP path (kernel 6.12.87)
Kernel CVE Fixes
CVE-2026-43284 HIGH Linux kernel (IPsec ESP)
Security Backported six upstream dnsmasq CVE fixes to 2.91
dnsmasq CVE Fixes
CVE-2026-2291 HIGH dnsmasq
CVE-2026-4890 MEDIUM dnsmasq
CVE-2026-4891 MEDIUM dnsmasq
CVE-2026-4892 MEDIUM dnsmasq
CVE-2026-4893 MEDIUM dnsmasq
CVE-2026-5172 MEDIUM dnsmasq
FIRMWARE 17 May 2026

25.12.3

Upgrade to core OpenWRT 25.12.3. Updates cryptographic libraries (mbedtls, OpenSSL, wolfSSL) with multiple CVE fixes.

Security Fixed Linux kernel "Copy Fail" vulnerability (limited applicability)
OpenWRT 25.12.3 CVE Fixes
CVE-2026-31431 MEDIUM Linux kernel
Security Updated mbedtls to 3.6.6 (multiple CVE fixes)
Security Updated OpenSSL to 3.5.6 (multiple CVE fixes)
Security Updated wolfSSL to 5.9.1 (multiple CVE fixes)
FIRMWARE 3 April 2026

25.12.2

Upgrade to core OpenWRT 25.12.2. Fixes an mbedtls regression causing broken TLS 1.2 client connections affecting DDNS and other services.

Bug Fix Fixed mbedtls regression causing broken TLS 1.2 client connections (affected DDNS and other services)
FIRMWARE 28 March 2026

24.10.6

Upgrade to core OpenWRT 24.10.6. Includes fixes from the Trail of Bits security audit covering umdns, jsonpath, and procd.

Security Fixed stack buffer overflow in umdns DNS PTR query handling
Trail of Bits Audit Fixes
CVE-2026-30871 HIGH umdns
Security Fixed stack buffer overflow in umdns IPv6 reverse DNS lookup
Trail of Bits Audit Fixes
CVE-2026-30872 HIGH umdns
Security Fixed memory leak in jsonpath when processing strings, labels, and regexp tokens
Trail of Bits Audit Fixes
CVE-2026-30873 CRITICAL jsonpath
Security Fixed command execution via PATH environment variable filter bypass in procd
Trail of Bits Audit Fixes
CVE-2026-30874 CRITICAL procd
FIRMWARE 26 March 2026

25.12.1

Upgrade to core OpenWRT 25.12.1. Includes the same Trail of Bits security audit fixes as 24.10.6.

Security Fixed stack buffer overflow in umdns DNS PTR query handling
Trail of Bits Audit Fixes
CVE-2026-30871 HIGH umdns
Security Fixed stack buffer overflow in umdns IPv6 reverse DNS lookup
Trail of Bits Audit Fixes
CVE-2026-30872 HIGH umdns
Security Fixed memory leak in jsonpath when processing strings, labels, and regexp tokens
Trail of Bits Audit Fixes
CVE-2026-30873 CRITICAL jsonpath
Security Fixed command execution via PATH environment variable filter bypass in procd
Trail of Bits Audit Fixes
CVE-2026-30874 CRITICAL procd
FIRMWARE 14 March 2026

25.12.0

Major upgrade to OpenWRT 25.12.0 "Dave's Guitar" with Linux kernel upgraded from 6.6 to 6.12. Package manager switched from opkg to apk.

New Feature Upgraded to OpenWRT 25.12 series with Linux kernel 6.12
New Feature Package manager switched from opkg to apk
Security Security posture improved through wholesale component upgrades
FIRMWARE 27 December 2025

24.10.5

Upgrade to core OpenWRT 24.10.5. Fixes a privilege escalation vulnerability in dropbear.

Security Fixed privilege escalation via Unix domain socket forwarding (dropbear)
OpenWRT 24.10.5 CVE Fixes
CVE-2025-14282 HIGH dropbear
FIRMWARE 31 October 2025

24.10.4

Upgrade to core OpenWRT 24.10.4. Fixes a heap buffer overflow in ubusd event handling.

Security Fixed heap buffer overflow in ubusd event register message handling (allows authenticated RCE / privilege escalation)
OpenWRT 24.10.4 CVE Fixes
CVE-2025-62526 CRITICAL ubusd
FIRMWARE 30 September 2025

24.10.3

Upgrade to core OpenWRT 24.10.3. Bug fix and device support release.

Bug Fix Bug fix and device support improvements
FIRMWARE 23 August 2025

23.05.6

Upgrade to core OpenWRT 23.05.6. Security fixes via component updates. This is the final release of the 23.05 series.

Security Security fixes via component updates
Deprecated Final release of the OpenWRT 23.05 series
FIRMWARE 4 July 2025

24.10.2

Upgrade to core OpenWRT 24.10.2. Bug fix and device support release.

Bug Fix Bug fix and device support improvements
FIRMWARE 22 April 2025

24.10.1

Upgrade to core OpenWRT 24.10.1. Bug fix and device support release.

Bug Fix Bug fix and device support improvements
FIRMWARE 15 February 2025

24.10.0

Major upgrade to OpenWRT 24.10.0 with Linux kernel upgraded from 5.15 to 6.6. Security posture improved through wholesale component upgrades.

New Feature Upgraded to OpenWRT 24.10 series with Linux kernel 6.6
Security Security posture improved through wholesale component upgrades
FIRMWARE 5 October 2024

23.05.5

Upgrade to core OpenWRT 23.05.5. Security fixes via component updates.

Security Security fixes via component updates
FIRMWARE 2 August 2024

22.03.7

Upgrade to core OpenWRT 22.03.7. This is the final release of the 22.03 series, including three CVE fixes and updated cryptographic libraries.

Security Fixed authentication bypass in WPA Enterprise client mode (hostapd)
OpenWRT 22.03.7 CVE Fixes
CVE-2023-52160 HIGH hostapd
Security Fixed integer overflow vulnerability in dropbear (libtommath)
OpenWRT 22.03.7 CVE Fixes
CVE-2023-36328 HIGH dropbear (libtommath)
Security Fixed SSH "Terrapin" attack integrity check bypass via Strict KEX mode (dropbear)
OpenWRT 22.03.7 CVE Fixes
CVE-2023-48795 HIGH dropbear
Improvement Updated wolfSSL from 5.6.4 to 5.7.2, mbedtls from 2.28.5 to 2.28.8, wireless-regdb updated
FIRMWARE 27 July 2024

23.05.4

Upgrade to core OpenWRT 23.05.4. Security improvements delivered via component updates.

Security Updated Linux kernel from 5.15.150 to 5.15.162
Security Updated mac80211 from 6.1.24 to 6.1.97-1 (includes security fixes)
Security Updated mbedtls from 2.28.7 to 2.28.8
Security Updated OpenSSL from 3.0.13 to 3.0.14
Security Updated libxml2 from 2.11.4 to 2.12.5
FIRMWARE 3 April 2024

23.05.3

Upgrade to core OpenWRT 23.05.3 with three CVE fixes covering dropbear and dnsmasq vulnerabilities.

Security Fixed integer overflow in dropbear (libtommath) mp_grow
OpenWRT 23.05.3 CVE Fixes
CVE-2023-36328 HIGH dropbear (libtommath)
Security Fixed SSH "Terrapin" attack bypass (dropbear)
OpenWRT 23.05.3 CVE Fixes
CVE-2023-48795 HIGH dropbear
Security Fixed DNSSEC NSEC3 closest encloser proof DoS via CPU exhaustion (dnsmasq)
OpenWRT 23.05.3 CVE Fixes
CVE-2023-50868 HIGH dnsmasq
FIRMWARE 11 December 2023

22.03.6

Upgrade to core OpenWRT 22.03.6. Security improvements delivered via component updates: Linux kernel 5.10.176 to 5.10.201, OpenSSL 1.1.1t to 1.1.1w, wolfSSL 5.5.4 to 5.6.4, mbedtls 2.28.2 to 2.28.5.

Security Updated Linux kernel from 5.10.176 to 5.10.201
Security Updated OpenSSL from 1.1.1t to 1.1.1w
Security Updated wolfSSL from 5.5.4 to 5.6.4
Security Updated mbedtls from 2.28.2 to 2.28.5
FIRMWARE 21 November 2023

23.05.2

Upgrade to OpenWRT 23.05.2. Bug fix and device support release. Note: 23.05.1 was skipped upstream due to a severe bug.

Bug Fix Bug fix and device support improvements
FIRMWARE 1 October 2023

V2.2.0

(22.03.5)

Update for the portal Quality of Life update.

New Feature Added upgrade reporting including version number
Bug Fix Fixed an issue with WiFi channel selection
PORTAL 22 May 2023

Version 1.3

Mainly a quality of life update.

New Feature Added router version to portal
New Feature Added a version history for router upgrade
Improvement Amended the colour of connected router to match theme
Improvement Adjusted some layouts to make them cleaner and easier to read
PORTAL 11 May 2023

Version 1.2

This release adds a new heartbeat feature and tidies things up a little more.

New Feature Added device heartbeat, showing the router has an internet connection and the last time it checked in
Improvement Restyled the menus to make it easier to find things and save some space
FIRMWARE 11 May 2023

V2.1.5

(22.03.5)

This release updates the core OpenWRT to Version 22.03.5, it also adds new features and fixes a couple of bugs.

New Feature Support for using a Wireless connection for primary internet connection (WWAN)
New Feature Added an additional device heartbeat sent to the portal, showing if the device is connected to the internet but the VPN is not for some reason
New Feature Selective backup + restore to preserve WWAN configuration when updating
Security Updated core OpenWRT from 22.03.03 to 22.03.5 which includes 13 CVE fixes
OpenWRT 22.03.04 CVE Fixes
CVE-2022-4304 MEDIUM OpenSSL
CVE-2022-4450 HIGH OpenSSL
CVE-2022-47522 UNKNOWN WiFi Client Isolation Bypass
CVE-2022-47938 MEDIUM ksmbd
CVE-2022-47939 CRITICAL ksmbd
CVE-2022-47940 HIGH ksmbd
CVE-2022-47941 HIGH ksmbd
CVE-2022-47942 HIGH ksmbd
CVE-2022-47943 HIGH ksmbd
CVE-2023-0215 HIGH OpenSSL
CVE-2023-0286 HIGH OpenSSL
OpenWRT 22.03.05 CVE Fixes
CVE-2023-0464 HIGH OpenSSL
CVE-2023-0465 MEDIUM OpenSSL
Security Enhanced security on local web server
Bug Fix Inactivity was causing the router to incorrectly show as disconnected
Bug Fix Fixed listening port for local web server
PORTAL 1 March 2023

Version 1.1

This update brings some exciting new features and takes the portal to the next milestone.

New Feature Ability to assign routers to a pool ready for company deployment
New Feature Automatic updates of router firmware
New Feature Manage router password from portal
New Feature Router configuration using username and password assigned in portal
New Feature Fully automated deployment of router when assigned to a user
New Feature Manage WiFi details company-wide from portal
Improvement CSS refresh to align with Loxada branding
PORTAL 1 October 2022

Version 1.0

This is the first public release of our management portal.

New Feature Add devices to portal
New Feature Device status reporting
FIRMWARE 1 October 2022

20230301-A

Our initial public release based on a hardened OpenWRT 22.03.3.

New Feature Guided setup and configuration
New Feature Fully automated deployment and setup
New Feature Loxada Cloud Management
New Feature Cloud managed firmware update
New Feature Based on latest OpenWRT 22.03.3