OpenWrt 24.10.8 – safe to update?
0 problem reports and 0 positive reports found on Reddit (plus 1 other mention). Out for 84 days and we haven't found any problem reports. Quiet isn't proof — but most bad releases get noticed within a week.
⚠ Read before updating
The official notes for this release include changes that may not be reversible or that remove things you might rely on:
- The OpenWrt 24.10 series is in security maintenance (only security problems are fixed), with end of life (EoL) projected for September 2026.
Security update: this release fixes security issues (highest CVSS 9.6). Waiting carries its own risk — if your device is exposed, weigh that against the reports below.
Did you install 24.10.8?
Thanks — your vote is counted.
What's in this release
The OpenWrt community is proud to announce the newest stable release of the OpenWrt 24.10 stable series. This release fixes many security issues, several of them remotely triggerable in network services that are enabled by default. We strongly recommend everyone to upgrade. The OpenWrt 24.10 series is in security maintenance (only security problems are fixed), with end of life (EoL) projected for September 2026. We…
Source: forum.openwrt.org announcements
CVEs fixed
- CVE-2026-62948 CRITICAL 9.6 (named in release notes)
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping,… - CVE-2026-53922 MEDIUM 6.5 (named in release notes)
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RE… - CVE-2026-62947 MEDIUM 4.9 (named in release notes)
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FN… - CVE-2026-53918 (named in release notes)
Not yet published in NVD. - CVE-2026-53920 (named in release notes)
Not yet published in NVD. - CVE-2026-53921 (named in release notes)
Not yet published in NVD. - CVE-2026-55612 (named in release notes)
Not yet published in NVD. - CVE-2026-55613 (named in release notes)
Not yet published in NVD. - CVE-2026-55614 (named in release notes)
Not yet published in NVD.
Community reports
- Mention
Upgrading from 24.10.8 to 25.12.5 issue on Mercusys MR90X · Reddit · 2026-09-08
I have Openwrt on a Mercusys MR90X. Have successfully upgraded to 24.10.8 with no issues. However, upgrading to 25.12.5 leaves me with no internet. Router takes the firmware but doesn't connect to internet modem (IPoE so no login/password). Given the other upgrades were painless…
Reports are found automatically and labelled by an AI model plus keyword rules — they can be wrong. Open the post to judge for yourself.
← OpenWrt 24.10.7 · OpenWrt 25.12.0 →
Other OpenWrt versions
- 25.12.6 2026-10-18
- 24.10.8 2026-07-26
- 25.12.5 2026-07-01
- 24.10.7 2026-05-31
- 25.12.4 2026-05-14
- 25.12.3 2026-05-07
- 25.12.2 2026-03-27
- 25.12.1 2026-03-18
The weekly "safe to update?" email
One short email a week: what shipped, what broke, and what's safe to install. No spam.
Thanks — you're on the list.
We store only your email address and the date you signed up, to send this newsletter. We never sell or share it. Every email will have a one-click unsubscribe; you can also ask us to delete your address at any time. Privacy details.