OpenWrt 25.12.6 Fixes Certificate Validation Flaw and Revises WPA3 Defaults

OpenWrt released 25.12.6 as the latest stable update in its 25.12 series, replacing 25.12.5 with security fixes, wireless compatibility changes and networking component updates. Its changelog lists CVE-2026-6091, a certificate-validation flaw in wolfSSL’s OpenSSL compatibility certificate-path-building code. When X509_V_FLAG_PARTIAL_CHAIN is enabled, verification may accept a chain ending at a peer-supplied, untrusted intermediate certificate rather than a trusted anchor. An attacker could exploit this by presenting a chain ending at an intermediate certificate they control. Separate reporting also identifies security fixes affecting uhttpd, Mbed TLS, hostapd, wpa_supplicant, rpcd, cgi-io, LuCI and ead-client, although precise vulnerability details are limited. The supplied references report no active exploitation.

The release stops offering GCMP-256 and SAE-EXT-KEY by default in WPA3-Personal and WPA2/WPA3 mixed modes because of client compatibility problems, while allowing administrators to enable them explicitly. A new WPA3-Personal Compatibility Mode enables these features by default on Wi-Fi 7 radios through an RSN Override element that older clients ignore. Beacon protection is now enabled by default when protected management frames are enabled, and WPA2-only configurations on 6 GHz automatically switch to WPA3. Administrators should review wireless compatibility and device-specific upgrade precautions before deployment, particularly the documented risk of configuration loss on bcm53xx devices with NAND flash, and back up configurations before upgrading.