OpenWrt routers: firmware upgrades and package updates

Updated November 2026

On OpenWrt you patch by installing a new firmware image, not by upgrading packages one by one. Run owut upgrade or use Attended Sysupgrade in LuCI to get the latest 25.12 release with your settings and extra packages kept. As of November 2026, 25.12 is the only supported release series.

Supported releases

OpenWrt supports a major release until one year after its first release or six months after the next major release, whichever is later. After that it is end of life and gets no fixes at all, "even for severe security vulnerabilities", in the project's words.

OpenWrt support status (as of November 2026)
Series	Status	First release	Latest release	End of life
25.12	Supported	March 6, 2026	25.12.6 (October 18, 2026)	Not yet announced
24.10	End of life	February 6, 2025	24.10.8 (July 26, 2026)	September 2026
23.05	End of life	October 13, 2023	23.05.6 (August 20, 2025)	August 2025

This schedule covers the core packages only. The extra package feeds are run by volunteer maintainers, and some do not support every OpenWrt release.

Check your release

Over SSH (as root):

ubus call system board

The release block shows the version (for example 25.12.6) and the target, which you need to pick the right image. The SSH login banner and the LuCI Status > Overview page show the version too.

Why not just upgrade packages?

On Debian or Fedora you would run the package manager. OpenWrt asks you not to. Its documentation calls apk upgrade and opkg upgrade "very highly discouraged" and warns that bulk upgrades can soft-brick the router. The reasons:

The package manager does not check binary (ABI) compatibility or kernel version dependencies, so an upgraded library or kernel module can break other parts of the system.
The base system sits in a compressed read-only partition. Upgraded packages are written a second time into the small writable overlay and can fill the flash.
The kernel and kernel modules cannot be fixed with a package update at all. Kernel fixes reach you only in a new minor release.

The LuCI Upgrade... button on the Software page runs the same command, so the warning applies to it too. Important security fixes are shipped quickly as a stable maintenance release (25.12.1, 25.12.2 and so on), and that is what you install.

opkg or apk? OpenWrt 25.12 replaced the opkg package manager with apk (Alpine Package Keeper). opkg update becomes apk update, and opkg install pkg becomes apk add pkg. Releases 24.10 and older still use opkg. The rule above applies to both.

One exception: optional packages that are not in the default image, such as OpenVPN or BIND from the package feed, also get security updates between releases. The safe way to pick them up is still an Attended Sysupgrade, which builds an image with the current version of every package you installed. If you upgrade one of them by hand, do it for that single package only, never in bulk, and be ready to reset the router if it goes wrong.

Back up first

Every upgrade guide on openwrt.org starts here. In LuCI, go to System > Backup / Flash Firmware and click Generate archive. On the command line (as root):

sysupgrade -l
sysupgrade -b /tmp/backup.tar.gz

-l lists the files that will be saved (from /etc/sysupgrade.conf and /lib/upgrade/keep.d/); add any custom files to /etc/sysupgrade.conf. Then copy the archive off the router, from your PC:

scp -O root@192.168.1.1:/tmp/backup.tar.gz .

The -O flag makes OpenSSH 9 and later use the old SCP protocol, because OpenWrt does not install an SFTP server by default. Also keep a copy of the image you are running now, in case you need to go back.

Upgrade with Attended Sysupgrade

Attended Sysupgrade (ASU) asks the build server at sysupgrade.openwrt.org to build an image for your device that already contains all the packages you installed. It downloads the image, checks its SHA-256 checksum against the server's value, flashes it and keeps your settings. In 25.12 the LuCI app and the command-line client owut are installed by default on most devices. On 24.10 install them first with opkg update && opkg install owut luci-app-attendedsysupgrade.

From the command line

owut check
owut upgrade

owut check is safe: it only shows the target version and which packages would change. owut upgrade stays on your current branch, so on 25.12.4 it moves you to the newest 25.12 release. It flashes the image and reboots the router, so the network goes down for a few minutes. If owut finds package downgrades, it stops; read the forum support thread before you add --force. Also read any warning about missing default packages before you go on.

From LuCI

Go to System > Attended Sysupgrade and click Search for sysupgrade.
Pick the version and click Request Sysupgrade. Wait while the server builds the image.
Leave Keep settings ticked and click Install Sysupgrade. The router flashes and reboots.

Settings and installed packages carry over; the whole firmware image is replaced each time.

Manual sysupgrade

Without ASU, download the -sysupgrade.bin image for your exact model from the Firmware Selector (x86 uses the same "combined" image type you installed). Put it in /tmp, which lives in RAM; sysupgrade will not flash a file stored anywhere else. Check that free shows room for it, verify the checksum against the sha256sums file from the same download folder, then flash:

cd /tmp
sha256sum -c sha256sums 2>/dev/null | grep OK
sysupgrade -T /tmp/openwrt-25.12.6-...-squashfs-sysupgrade.bin
sysupgrade -v /tmp/openwrt-25.12.6-...-squashfs-sysupgrade.bin

Replace the file name with your real one. -T only tests the image and configuration. The last command wipes the file system, flashes and reboots. Settings are kept by default; -n starts from a clean configuration. A manual sysupgrade does not keep packages you installed yourself, so reinstall them afterwards (sysupgrade -k saves a list to /etc/backup/installed_packages.txt to help).

The wiki also suggests skipping "keep settings" every 12 to 16 months and rebuilding the configuration, to avoid odd problems from old settings.

Keep LuCI off the WAN

By default the OpenWrt firewall blocks all incoming traffic on the WAN zone, so LuCI and SSH are reachable only from the LAN. Keep it that way. LuCI has no built-in brute-force protection, and 25.12.6 alone fixed several flaws in the uhttpd web server that could be reached without logging in. To manage a router remotely:

Use a VPN on the router (WireGuard or OpenVPN) and reach LuCI on its LAN address.
Or tunnel LuCI over SSH with key-only login: ssh -L 8080:127.0.0.1:80 root@192.168.1.1, then open http://localhost:8080/.
Set a strong root password right after a fresh install or a clean upgrade; OpenWrt starts with none.
Do not add a firewall rule that opens port 80, 443 or 22 to the internet.

Where fixes are announced

Security advisories: openwrt.org/advisory/start, with an RSS feed. These cover only components the project maintains itself (uhttpd, procd, rpcd and similar).
Release notes: each 25.12.x note lists the security fixes, including those in the Linux kernel, OpenSSL, Mbed TLS and hostapd.
Mailing list: openwrt-announce, for new releases and security announcements, and the Announcements category of the OpenWrt forum.

On an end-of-life release

If the router runs 24.10 or older, it is getting no fixes. Upgrading from 24.10 to 25.12 with settings kept works on most devices: run owut upgrade --version-to 25.12 after owut check --version-to 25.12, or pick 25.12 in the LuCI app, and read the 25.12 release notes for device-specific warnings first. A direct sysupgrade from 23.05 to 25.12 is not officially supported. The safest route from an old release is a clean install: back up, flash the 25.12 image with sysupgrade -n, and rebuild the configuration using the backup as a guide. If 25.12 no longer supports your hardware, replace the router. See Is my OS supported? for planning.