Major Update: Linux Kernel 5.15.183, Enhanced Security, and Expanded WWAN/WLAN Capabilities

New Features

• WWAN improvements
  #531023, Multiple PDP contexts, for 4G PDP (Packet Data Protocol) or 5G PDU (Protocol Data Unit) sessions are now supported for devices with Telit and uBlox Lara modems.
• Techsupport improvements
  #548863, The techsupport file has been updated to now contain also the oem-config.cfg and factory-config.cfg files.
  #625666, When exporting techsupport files the factory configuration will now be located in a separate file to unclutter the logs.
• Web-UI improvements
  #560124, Improved information quality on IP settings page when WLAN monitor mode is configured.
  #642630, HTTPS redirection for the Web-UI is now activated by default when setting up a new device or after a factory reset.
• WLAN fixes
  #566682, Improved WLAN roaming switchover behaviour and mitigated undesired flipping between connections.
• WLAN improvements
  #572658, CLI status now also shows WLAN channel and frequency.
• Device identification
  #606205, Hirschmann Serial Numbers (HSN) have been added to techsupport, CLI and Web-UI.
• CAN improvements
  #609644, Virtual CAN devices are now enabled in the Kernel and can be used from within a LCX container.
• Updated system components
  #617276, base-passwd to version 3.5.52, dnsmasq to version 3.0.27, freeradius to version 3.0.27, gcc to version 11.5.0, mosquitto to version 2.0.20, openssl to version 3.0.16, openvpn to version 2.5.11, php to version 8.1.31, rsync to version 3.2.7, tzdata to version 2024b, wireless-regdb to version 2024.10.07
• Feature license activation
  #619826, From this release forward all NRSW feature licenses are activated by default.
• Linux kernel update
  #630257, The system kernel has been updated to Linux kernel 5.15.183. Kernel 5.15.183 incorporating upstream security patches, improved hardware driver support, and enhanced system stability. This update includes fixes for known vulnerabilities and performance optimizations relevant to modern workloads.

Security Fixes

• RADIUS fixes
  #577010, CVE-2024-3596: The RADIUS protocol had a vulnerability that potentially made it susceptible to forgery attacks, which could modify the Access-Accept or Access-Reject RADIUS response, this is fixed.
• Persistent logging improvements
  #605317, Log files now reflect user creations, modifications, and authentications.
• Improved logged information quality
  #605966, User account interactions were added to the system log.
• SSH security improvements
  #642632, DSS ciphers have been disabled to enhance cryptographic robustness. An Ed25519 key pair is now generated by default alongside RSA, providing stronger and faster key options. Additionally, the web UI now supports uploading Ed25519 public keys, making it easier to manage modern key types.

Fixes

• Event handling
  #401463, wanlink down and up events have been extended to include whether the link in question was a hotlink.
• SIM PIN fix
  #418812, Saving a wrong SIM PIN could result in a locked SIM card. Now, the SIM PIN will not be retried once reported wrong by the SIM card unless the user forces a retry.
• WLAN fixes
  #548861, When switching to "Dual Mode", from an already configured Access Point mode on the WLAN1 card, the new access point could not be configured correctly.
  #559982, The fast Transition feature is now working properly for WPA3 configurations in access point AP mode and preauthentication PreAuth for WPA2.
  #567523, Configuring multiple alias IPs on a WLAN client device could result in unsolicited netmask changes during operation.
  #568830, Specific WLAN configurations could result in a wrongfully terminating daemon and lead to a reboot loop.
  #614829, After performing a WLAN network scan on a WLAN devices bridged to a LAN device, the WLAN interface did not come up anymore.
  #619858, While having a WLAN-LAN bride configured and a DFS event was received the entire bridge device would go down.
• Network fixes
  #553114, In some scenarios, changing the DNS setting during a DHCP renewal resulted in the device to set the link state to down.
• BGP fixes
  #568811, In some cases, BGP packets were not properly routed via WWAN interfaces when updating an existing configuration from an older NRSW version.
• Modem fixes
  #571476, On hardware variants(NB18x0, NB28x0, NB3800) with Telit modems some characters in provider APNs would lead to an error and no connection could be established.
• Web-UI fixes
  #572625, Web-UI password fields still validated the old minimum, of six characters instead of the actual required ten characters. Actual password length requirements were not affected.
  #587216, After uploading applying a configuration file, in some cases the web-UI reported the config update as successful, even although it had failed.
  #588116, Improved WLAN scanning information quality.
  #607275, On rare occasions, opening a sub on Web-UI, menu could lead to an HTTP status code 500.
• 802.1X fixes
  #584104, Wired 802.1X would not work if the devices was used as a WLAN client at the same time.
• Firewall fixes
  #584117, There has been an issue, where firewall rules would have been created, even if the automatic firewall setup was declined when setting up a WAN connection.
• MAC address changes after update
  #588781, On NB1601 and NB800, there could be changes to the ethernet addresses detected, after an update from NRSW 4.8.
• IPSEC fixes
  #590128, IPSEC configurations containing FQDN remote peer addresses could not be started, when the firewall policy was configured to drop DNS traffic.
• WWAN fixes
  #609282, In some circumstances, certain AT packets could cause an interrupted WWAN connection.
• Voice call audio issues
  #612476, On certain hardware platforms, such as the NB3701, voice calls would have no audio.
• CAN fixes
  #614756, The CAN module drivers were not loaded correctly.
• GPS fixes
  #615243, It was not possible to decrease the GPS Fix frame interval below three seconds. This has been fixed.
• DNS fixes
  #615246, After updating a device with an active IPv6 setup, the dnsmasq service did not start correctly.
• Captive portal fixes
  #619868, Errors may occur when configuring multiple hotspots with captive portal setups.
• ITxPT fixes
  #625623, When using ITxPT with a GNSS enabled system, a reboot could occur due to a service crash in some circumstances.
• LXC fixes
  #644034, Fixed compatibility issues when using Node-Red in an LXC container.

Known Issues

• WAN-MTU
  #578728, If the cellular network does not provide MTU information, ublox LARA-L6 modems use 1428 Byte as a default. This may lead to issues if an MTU of 1500 is expected.
• OpenVPN issues
  #630573, When using OpenVPN tunnel in expert client mode disabling the setting " Apply network settings pushed by OpenVPN server" will require a router reboot to apply correctly.
• WWAN connection MTU issue
  #639705, When manually setting an MTU value smaller than the MTU used by the mobile network carrier for a router with a uBlox TOBY-L2 modem, the router will reboot if it receives packets with a larger-than-configured MTU size from the mobile connection. Do not configure MTU sizes smaller than what the mobile network carrier specifies.
• Config options breaks GNSS functionality
  #643066, The legacy config option gpsd.0.ftimeout will break GNSS functionality and NMEA stream if set to "1" via CLI.
• Downgrade warning
  #670564, Starting with NRSW 5.0.0.100 we only support signed Software images. Therefore a downgrade to NRSW Releases 4.9 and earlier is not possible.
• Dnsmasq error in combination with hotspot on vlan
  #670580, Analysis shows that a router can reboot if you have a hotspot running on a routed VLAN interface due to a watchdog reboot of the dnsmasq process. Please contact support for a workaround.
• WLAN mesh point
  #670584, The mesh point functionality of WLAN does not work on NB160