Skip to main content

Release Notes for Version 6.6.0

Release Date: December 17, 2025

Warning

  • Due to the significant changes introduced in the 6.4.x, 6.5.x, and 6.6.x releases, extensive testing of the new firmware is strongly recommended before deploying it in operational environments, especially when upgrading from version 6.3.x.
  • Several Router App functions have been integrated directly into the firmware. Existing Router App configuration is not converted during the upgrade. Users must reconfigure the corresponding functionality in the firmware and then uninstall the related Router Apps. The same feature must not be enabled simultaneously in both the firmware and the original Router App.

Added

  • Added an Enable Port option to the Ethernet configuration of all products.
  • Extended configuration of the switched ETH0 port on ICR-25xx/26xx and ICR-44xx:
    • Added Enable Ports option for each individual port.
    • Extended Media Type selection to individual ports.
    • Added VLAN Filtering, which restricts switch ports to forwarding traffic only for specified VLANs.
  • Added Quick Setup page shown after the first login, which helps users quickly set up initial connectivity.
  • Integrated functionality from several Router Apps:
    • Added Geolocation and GNSS to General Status page, added location reporting via SNMP, and added GNSS Configuration page to enable location tracking. This integrates the former GPS Router App.
    • Added ability to Send SMS when digital input turns Off, added support for variables in Digital Input SMS configuration, and added Inputs/Outputs Configuration page for managing digital outputs and USR LED. This integrates the former IO Control and USR LED Management Router Apps.
    • Added Events Configuration page for triggering SMS, e-mails, SNMP traps, or script invocation upon various events. This integrates the former Event Notificator Router App.
    • Added Reboot Schedule configuration that enables scheduled reboots of the router at a user-defined time. This integrates the former Daily Reboot Router App.
    • Enabled the Mobile WAN Operator option to include a comma-separated list allowing the router to attach to any listed PLMN. This serves as a PLMN Whitelist.
  • Extended firewall configuration:
    • Added Input Interface and Output Interface selection to Firewall Configuration. The list includes all available interfaces, plus the WAN and LAN zone.
    • Rule descriptions are stored in iptables as comments, so users can easily recognize which rule relates to which firewall setting. The comments can also be provided from the command-line using the -m comment --comment "XYZ" arguments.
  • Added option to Separate Child SA for Each Subnet to IPsec Tunnel Configuration.
  • Added Security Level selection to HTTP Configuration. A higher level disables weak ciphers in security-sensitive environments. You may need to Generate a new certificate, because keys generated at a lower level may not be usable at a higher level.
  • Implemented configuration conversion after firmware upgrade on S1 routers.
  • Extended annotations in the Web administration:
    • Added Router App announcements to the top-right corner, providing clear visibility for messages such as WebAccess/DMP notifications. The device Name was moved to the second line, next to the device Location.
    • Added help strings. For numeric values, these indicate the allowed ranges.
    • Input field tooltips now show item names from the configuration files.
  • Added warning when the user enters non-ASCII input to the Web administration. Such characters are not supported. For example, non-ASCII passwords may not be accepted.
  • Extended the status command:
    • Added status geolocation and status gnss commands.
    • Added status hw command that displays available hardware functions. This information is also included in the System Report.
    • Added status sim command that displays SIM statistics.
  • Added the bridge command for advanced control of bridge devices.
  • Added the ether-wake command for generating Wake-On-LAN (WOL) messages, used to restart machines that were soft powered down.
  • Extended the System Report:
    • Added more details on configured VLANs.
    • Added Crash Log and Crash Dump Storage Statistics.
  • Added option to Save Diagnostic Data on the System Log page. Diagnostic data include crash dumps that help with debugging and troubleshooting but may contain sensitive information.
  • Added support for external PCAN-USB adapters to RBv3 and all ICR-4xxxx products.
  • Added a list of configuration items to the firmware release.

Changed

  • Separated the WiFi Country selection to a standalone page. There is now a single Country selection applicable to all WiFi APs and STAs.
    • Due to FCC regulations, this page is not available on NAM products, where the Country is fixed to US. On global products, users can select either 00 (all countries) or US only.
    • After changing the Country, always review HW Mode, Bandwidth, and Channel selection in WiFi AP configuration. Settings invalid for the given country are disabled and cannot be selected, but previously valid selection is preserved until changed by the user.
    • During firmware upgrade, configurations with different Country settings for WiFi STA and AP will be converted to a single Country. As a result, some radio settings may become invalid and prevent AP/STA from operating until reconfigured. Please review and re-apply your WiFi AP configuration and verify that your WiFi STAs are still able to connect.
  • Changed the default forwarding rule in Firewall Configuration to match all traffic with Input Interface in LAN. Since 6.5.0, the rule matched traffic with Source Address 192.168.1.0/24 only.
  • Increased the maximum number of Local and Remote Subnets in the IPsec Tunnel Configuration from 2 to 10. Unused items are automatically hidden.
  • Changed SMS Phone Number configuration. Instead of three separate fields, a single field is now used that allows multiple comma-separated values.
  • Unified NTPv4 implementation on ICR-20,24,25/2600: switched to chrony 4.6.1, matching the implementation used since release 6.5.2 on all other products.
  • Modified NTP Configuration to allow time synchronization with multiple backup sources, GNSS and/or Cellular network. The Cellular network time synchronization is not available on SR303 FM, SR305 FM, and ST352 EoL.
  • Increased default NTP Maximal Polling Interval from ~1 minute to ~1 hour.
  • Disallowed Mobile WAN Configuration with incomplete credentials; both Username and Password must be set or empty.
  • Enhanced System Information status:
    • Added Part Number and moved Product Type and Product Name to the verbose mode. On special products, the Part Number and Product Type may differ.
  • Enhanced Mobile Network Information status:
    • Fixed Model name to display the exact module variant, e.g. for EC25-EUX the entire name is displayed instead of just EC25.
    • Added Firmware Release name that unambiguously identifies used cellular module firmware.
    • Added IMSI and SMS Center number.
  • Consolidated System configuration:
    • Moved Automatic Update and Authentication Configuration under System.
    • Moved Name, Location, Contact, and Custom identifiers from SNMP Configuration to a new Identification Configuration page under System.
    • Added Hostname setting.
  • Consolidated Peripheral Ports configuration:
    • Moved Expansion Port and USB Port menu items under Peripheral Ports.
    • Renamed Binary Input/Output labels to Digital Input/Output in the General Status page, Mobile WAN Configuration page, and SMS Configuration pages.
  • Moved Set SMS Service Center, Unlock SIM Card and Unblock SIM Card under a single menu item Manage SIM.
  • Updated the company logo in Web administration to follow corporate standards.
  • Increased maximum size of X.509 certificates from 6 kB to 8 KiB.
  • Renamed ppp* tunnel interface names. The names usb0 and usb1 are always used for 1st and 2nd Mobile WAN. PPPoE interfaces were renamed to pppoe0, L2TP to l2tp0, and PPTP to pptp0.
  • Changed the default URL scheme of Automatic Update to https: for improved security. To continue using HTTP, specify the http:// prefix explicitly.
  • Enhanced Emergency Reset:
    • Added removal of account locks.
    • Added factory reset of the cellular module.
    • Increased security of configuration data wiping on ICR-2xxx-S1 and ICR-41xx/42xx devices.
  • Changed status commands to report sizes in kibibytes (1024 bytes).
  • Moved System Log files on S1 routers from /var/data/system to /var/log.
  • Upgraded to Linux kernel version 6.1.141. This brings upstream security patches and stability improvements.
  • Upgraded the ca-certificates bundle to the version from 2025-11-04.
  • Upgraded OpenSSL to version 3.5.4 because the 3.0.x branch is nearing its end-of-support date. This may impact interoperability with legacy systems.
  • Increased the default TLS security level to 1. Use the Security Level option in HTTP Configuration and OpenVPN Tunnel Configuration to adjust the level for a specific service.
  • Upgraded OpenSSH to version 10.2p1, to address CVE-2025-61984 and CVE-2025-61985.
  • Upgraded strongSwan to version 6.0.2, which is compatible with OpenSSL 3.5.
  • Upgraded OpenVPN to version 2.6.15, to address CVE-2025-2704.
  • Upgraded AIDE to version 0.19.2, to address CVE-2025-54389 and CVE-2025-54409.
  • Upgraded Pure-FTPd to version 1.0.52, to address CVE-2024-48208.
  • Upgraded jq to version 1.8.1, fixing several minor security issues.
  • Increased the ext4 system partition inode size to 256 bytes to ensure timestamp support beyond the year 2038, and unified the journal size across all platforms to 1 MiB.

Removed

  • Removed support for restoring configuration from firmware older than 6.2.0. Upgrade from an old firmware is still possible, but some configuration fields will be reset to defaults.
  • Removed FTP Helper settings from S1 routers, which do not support FTP.
  • Removed the deprecated gsmsms command. Use the sms command instead.

Deprecated

  • OpenVPN Compression is not recommended and users should avoid using it. This option no longer enables compression, it just enables the compression framing to be able to receive compressed packets.
  • Commands status lan X are deprecated; use status ethX instead.
  • Commands status ppp X are deprecated; use status mwan X instead.

Fixed

  • Fixed ICR-2x5x devices to be non-NAM products. This enables WiFi Country selection on these devices.
  • Fixed RS-485 detection on SR303 FM and SR304 routers with two RS-485 ports (SR303xx6xx and SR304xx6xx).
  • Fixed IPsec operation after an IP address change (e.g., after a SIM switch). Previously, the SNAT/DNAT tables were not updated correctly, causing some flows to be interrupted.
  • Fixed ETH status on ICR-44xx when Bridged. The Bridged status was not detected correctly and the IP Address was shown as Unassigned.
  • Fixed SMS support in ICR-2437 with ML620.
  • Fixed sending of SMS from the Verizon network to US-based recipients.
  • Fixed display of SNMP statusCPUUsage to provide the same value as the System Information status.
  • Fixed Timezone reconfiguration from the command line, e.g. via WA/DMP. Previously, a device reboot was required to apply timezone changes.
  • Fixed SSH Public Key displayed on the Modify User page. Previously, only the first 256 characters were shown.
  • Fixed the Interface list in the Static Routes configuration to show only available interfaces.
  • Fixed filtering of offered 40MHz wide Channels in WiFi AP configuration for the 2.4GHz band.
  • Fixed permissions to not display the Update Firmware page to non-admin users.
  • Fixed configuration restore, so settings are no longer changed when an empty file is provided.
  • Fixed the System Report to include the list of running processes with a full set of arguments.
  • Fixed lpm -i command argument checks. Only values between 1 and 16777215 seconds are accepted.