Release Notes
⚠
PHP vulnerabilities and eMudhra intermediate TLS certificates

All public facing sites have been updated, we will soon be releasing a new firmware to mitigate the CVE’s and also mitigate the eight eMudhra intermediate TLS certificates that were compromised

Release Notes

Firmware and portal updates for the Loxada managed router platform - new features, fixes, and security patches, all in one place.

FIRMWARE 8 July 2026

3.2.0

(25.12.5)

Upgrade to core OpenWRT 25.12.5. Major security release with 30+ CVE fixes across odhcpd, uhttpd, LuCI, OpenSSL, and core components.

Security Fixed critical vulnerabilities in odhcpd (DHCPv6/DHCPv4/RA server)
odhcpd CVE Fixes
CVE-2026-53921 CRITICAL odhcpd
CVE-2026-53918 HIGH odhcpd
CVE-2026-53920 HIGH odhcpd
CVE-2026-53922 MEDIUM odhcpd
CVE-2026-55606 MEDIUM odhcpd
Security Fixed unauthenticated stored XSS on the LuCI leases page via crafted DHCPv6 FQDN hostname
Security Fixed HTTP request smuggling vulnerabilities in uhttpd web server
uhttpd CVE Fixes
CVE-2026-55612 HIGH uhttpd
CVE-2026-55614 HIGH uhttpd
CVE-2026-55613 MEDIUM uhttpd
Security Fixed ACL bypass and arbitrary file read via path traversal in cgi-io
Security Fixed multiple LuCI privilege escalation and XSS vulnerabilities
LuCI CVE Fixes
CVE-2026-55897 HIGH luci-app-advanced-reboot
CVE-2026-55159 HIGH luci-app-adblock-fast
Security Fixed integer underflow causing pre-auth DoS in ead (Emergency Access Daemon)
ead CVE Fixes
CVE-2026-55490 MEDIUM ead
Security Updated Linux kernel to 6.12.94
Core Component CVE Fixes
CVE-2026-43500 HIGH Linux kernel
Security Updated OpenSSL to 3.5.7 (15 CVE fixes)
OpenSSL 3.5.7 CVE Fixes
CVE-2026-7383 HIGH OpenSSL
CVE-2026-9076 HIGH OpenSSL
CVE-2026-34180 MEDIUM OpenSSL
CVE-2026-34181 MEDIUM OpenSSL
CVE-2026-34182 MEDIUM OpenSSL
CVE-2026-34183 MEDIUM OpenSSL
CVE-2026-42764 MEDIUM OpenSSL
CVE-2026-42766 MEDIUM OpenSSL
CVE-2026-42767 MEDIUM OpenSSL
CVE-2026-42768 MEDIUM OpenSSL
CVE-2026-42769 MEDIUM OpenSSL
CVE-2026-42770 MEDIUM OpenSSL
CVE-2026-45445 MEDIUM OpenSSL
CVE-2026-45446 MEDIUM OpenSSL
CVE-2026-45447 MEDIUM OpenSSL
Security Fixed musl libc vulnerabilities
musl libc CVE Fixes
CVE-2026-6042 MEDIUM musl libc
CVE-2026-40200 MEDIUM musl libc
Security Fixed dropbear SCP client arbitrary file overwrite and additional SSH vulnerability
dropbear CVE Fixes
CVE-2019-6111 MEDIUM dropbear (SCP)
CVE-2026-35385 HIGH dropbear
FIRMWARE 23 May 2026

25.12.4

Upgrade to core OpenWRT 25.12.4. Fixes Linux kernel "Dirty Frag" privilege escalation and backports six dnsmasq CVE fixes.

Security Fixed Linux kernel "Dirty Frag" local privilege escalation via IPsec ESP path (kernel 6.12.87)
Kernel CVE Fixes
CVE-2026-43284 HIGH Linux kernel (IPsec ESP)
Security Backported six upstream dnsmasq CVE fixes to 2.91
dnsmasq CVE Fixes
CVE-2026-2291 HIGH dnsmasq
CVE-2026-4890 MEDIUM dnsmasq
CVE-2026-4891 MEDIUM dnsmasq
CVE-2026-4892 MEDIUM dnsmasq
CVE-2026-4893 MEDIUM dnsmasq
CVE-2026-5172 MEDIUM dnsmasq
FIRMWARE 17 May 2026

25.12.3

Upgrade to core OpenWRT 25.12.3. Updates cryptographic libraries (mbedtls, OpenSSL, wolfSSL) with multiple CVE fixes.

Security Fixed Linux kernel "Copy Fail" vulnerability (limited applicability)
OpenWRT 25.12.3 CVE Fixes
CVE-2026-31431 MEDIUM Linux kernel
Security Updated mbedtls to 3.6.6 (multiple CVE fixes)
Security Updated OpenSSL to 3.5.6 (multiple CVE fixes)
Security Updated wolfSSL to 5.9.1 (multiple CVE fixes)
FIRMWARE 3 April 2026

25.12.2

Upgrade to core OpenWRT 25.12.2. Fixes an mbedtls regression causing broken TLS 1.2 client connections affecting DDNS and other services.

Bug Fix Fixed mbedtls regression causing broken TLS 1.2 client connections (affected DDNS and other services)
FIRMWARE 26 March 2026

25.12.1

Upgrade to core OpenWRT 25.12.1. Includes the same Trail of Bits security audit fixes as 24.10.6.

Security Fixed stack buffer overflow in umdns DNS PTR query handling
Trail of Bits Audit Fixes
CVE-2026-30871 HIGH umdns
Security Fixed stack buffer overflow in umdns IPv6 reverse DNS lookup
Trail of Bits Audit Fixes
CVE-2026-30872 HIGH umdns
Security Fixed memory leak in jsonpath when processing strings, labels, and regexp tokens
Trail of Bits Audit Fixes
CVE-2026-30873 CRITICAL jsonpath
Security Fixed command execution via PATH environment variable filter bypass in procd
Trail of Bits Audit Fixes
CVE-2026-30874 CRITICAL procd
FIRMWARE 14 March 2026

25.12.0

Major upgrade to OpenWRT 25.12.0 "Dave's Guitar" with Linux kernel upgraded from 6.6 to 6.12. Package manager switched from opkg to apk.

New Feature Upgraded to OpenWRT 25.12 series with Linux kernel 6.12
New Feature Package manager switched from opkg to apk
Security Security posture improved through wholesale component upgrades
FIRMWARE 27 December 2025

24.10.5

Upgrade to core OpenWRT 24.10.5. Fixes a privilege escalation vulnerability in dropbear.

Security Fixed privilege escalation via Unix domain socket forwarding (dropbear)
OpenWRT 24.10.5 CVE Fixes
CVE-2025-14282 HIGH dropbear
FIRMWARE 31 October 2025

24.10.4

Upgrade to core OpenWRT 24.10.4. Fixes a heap buffer overflow in ubusd event handling.

Security Fixed heap buffer overflow in ubusd event register message handling (allows authenticated RCE / privilege escalation)
OpenWRT 24.10.4 CVE Fixes
CVE-2025-62526 CRITICAL ubusd
FIRMWARE 30 September 2025

24.10.3

Upgrade to core OpenWRT 24.10.3. Bug fix and device support release.

Bug Fix Bug fix and device support improvements
FIRMWARE 4 July 2025

24.10.2

Upgrade to core OpenWRT 24.10.2. Bug fix and device support release.

Bug Fix Bug fix and device support improvements
FIRMWARE 22 April 2025

24.10.1

Upgrade to core OpenWRT 24.10.1. Bug fix and device support release.

Bug Fix Bug fix and device support improvements
FIRMWARE 15 February 2025

24.10.0

Major upgrade to OpenWRT 24.10.0 with Linux kernel upgraded from 5.15 to 6.6. Security posture improved through wholesale component upgrades.

New Feature Upgraded to OpenWRT 24.10 series with Linux kernel 6.6
Security Security posture improved through wholesale component upgrades
FIRMWARE 5 October 2024

23.05.5

Upgrade to core OpenWRT 23.05.5. Security fixes via component updates.

Security Security fixes via component updates
FIRMWARE 27 July 2024

23.05.4

Upgrade to core OpenWRT 23.05.4. Security improvements delivered via component updates.

Security Updated Linux kernel from 5.15.150 to 5.15.162
Security Updated mac80211 from 6.1.24 to 6.1.97-1 (includes security fixes)
Security Updated mbedtls from 2.28.7 to 2.28.8
Security Updated OpenSSL from 3.0.13 to 3.0.14
Security Updated libxml2 from 2.11.4 to 2.12.5
FIRMWARE 3 April 2024

23.05.3

Upgrade to core OpenWRT 23.05.3 with three CVE fixes covering dropbear and dnsmasq vulnerabilities.

Security Fixed integer overflow in dropbear (libtommath) mp_grow
OpenWRT 23.05.3 CVE Fixes
CVE-2023-36328 HIGH dropbear (libtommath)
Security Fixed SSH "Terrapin" attack bypass (dropbear)
OpenWRT 23.05.3 CVE Fixes
CVE-2023-48795 HIGH dropbear
Security Fixed DNSSEC NSEC3 closest encloser proof DoS via CPU exhaustion (dnsmasq)
OpenWRT 23.05.3 CVE Fixes
CVE-2023-50868 HIGH dnsmasq
FIRMWARE 21 November 2023

23.05.2

Upgrade to OpenWRT 23.05.2. Bug fix and device support release. Note: 23.05.1 was skipped upstream due to a severe bug.

Bug Fix Bug fix and device support improvements
FIRMWARE 1 October 2023

V2.2.0

(22.03.5)

Update for the portal Quality of Life update.

New Feature Added upgrade reporting including version number
Bug Fix Fixed an issue with WiFi channel selection
PORTAL 22 May 2023

Version 1.3

Mainly a quality of life update.

New Feature Added router version to portal
New Feature Added a version history for router upgrade
Improvement Amended the colour of connected router to match theme
Improvement Adjusted some layouts to make them cleaner and easier to read
PORTAL 11 May 2023

Version 1.2

This release adds a new heartbeat feature and tidies things up a little more.

New Feature Added device heartbeat, showing the router has an internet connection and the last time it checked in
Improvement Restyled the menus to make it easier to find things and save some space
FIRMWARE 11 May 2023

V2.1.5

(22.03.5)

This release updates the core OpenWRT to Version 22.03.5, it also adds new features and fixes a couple of bugs.

New Feature Support for using a Wireless connection for primary internet connection (WWAN)
New Feature Added an additional device heartbeat sent to the portal, showing if the device is connected to the internet but the VPN is not for some reason
New Feature Selective backup + restore to preserve WWAN configuration when updating
Security Updated core OpenWRT from 22.03.03 to 22.03.5 which includes 13 CVE fixes
OpenWRT 22.03.04 CVE Fixes
CVE-2022-4304 MEDIUM OpenSSL
CVE-2022-4450 HIGH OpenSSL
CVE-2022-47522 UNKNOWN WiFi Client Isolation Bypass
CVE-2022-47938 MEDIUM ksmbd
CVE-2022-47939 CRITICAL ksmbd
CVE-2022-47940 HIGH ksmbd
CVE-2022-47941 HIGH ksmbd
CVE-2022-47942 HIGH ksmbd
CVE-2022-47943 HIGH ksmbd
CVE-2023-0215 HIGH OpenSSL
CVE-2023-0286 HIGH OpenSSL
OpenWRT 22.03.05 CVE Fixes
CVE-2023-0464 HIGH OpenSSL
CVE-2023-0465 MEDIUM OpenSSL
Security Enhanced security on local web server
Bug Fix Inactivity was causing the router to incorrectly show as disconnected
Bug Fix Fixed listening port for local web server
PORTAL 1 March 2023

Version 1.1

This update brings some exciting new features and takes the portal to the next milestone.

New Feature Ability to assign routers to a pool ready for company deployment
New Feature Automatic updates of router firmware
New Feature Manage router password from portal
New Feature Router configuration using username and password assigned in portal
New Feature Fully automated deployment of router when assigned to a user
New Feature Manage WiFi details company-wide from portal
Improvement CSS refresh to align with Loxada branding
PORTAL 1 October 2022

Version 1.0

This is the first public release of our management portal.

New Feature Add devices to portal
New Feature Device status reporting
FIRMWARE 1 October 2022

20230301-A

Our initial public release based on a hardened OpenWRT 22.03.3.

New Feature Guided setup and configuration
New Feature Fully automated deployment and setup
New Feature Loxada Cloud Management
New Feature Cloud managed firmware update
New Feature Based on latest OpenWRT 22.03.3