Critical (CVSS 9.0–10)
Fix or mitigation released within 14 days of confirmation. Advisory published with the release.
Product security
NavGATE OS · NavAP OS · NavCloud
Firmware releases and security updates
Every Navijin firmware release is digitally signed, published with its SHA-256 checksum, and delivered through NavCloud or by manual upload. This page lists the current releases, the release history and our security patch policy, so IT and security teams can plan updates with confidence.
- Signed
- Only Navijin-signed images install
- Verified
- SHA-256 published for every release
- Navijin-only
- Devices contact Navijin services only
- Managed
- Scheduled updates from NavCloud
Current releases
Latest firmware
Install the release for your exact model. Devices managed by NavCloud are offered the latest release automatically.
- L1
NavGATE OS 1.0.25 · NG-GE504-P gateway · 13 November 2026
File NavGATE-OS-1.0.25-NG-GE504-P.nfw · SHA-256 21a9c052ac620f0b966786efa76175764d5ead85df168a13d5b476229616d95d. Navijin-only connections: time synchronisation from time.navijin.com, no third-party DNS-over-HTTPS defaults, WAN health checks against Navijin servers only.
- L2
NavAP OS 1.0.17 · NW-AP625-2.5G access point · 13 November 2026
File NavAP-OS-1.0.17-NW-AP625-2.5G.nfw · SHA-256 707dcb663682781806bff87a9d3e0c910e9914b365195878ece9a17edc147974. Navijin-only connections: time synchronisation from time.navijin.com.
Release history
What changed in each release
- L1
NavGATE OS 1.0.25 · NavAP OS 1.0.17 · 13 Nov 2026
Devices connect only to Navijin services: time from time.navijin.com, no third-party DNS-over-HTTPS defaults, WAN health checks against Navijin servers, guest portal redirect to navijin.com.
- L2
NavGATE OS 1.0.24 · 13 Nov 2026
Product name NavGATE; new logos in the web interface, login banner and NavCLI; automatic host names NavGATE-xxxx.
- L3
NavGATE OS 1.0.23 · 12 Nov 2026
Hospitality captive portal: WhatsApp, SMS and form sign-in in five languages; guest records stored centrally in NavCloud.
- L4
NavGATE OS 1.0.22 · 12 Nov 2026
NavCloud device management fixes: connected access points, clients and IP addresses reported correctly; SSID, password and IP settings from NavCloud.
- L5
NavAP OS 1.0.16 · 12 Nov 2026
NavCloud management fixes for clients, IP reporting and Wi-Fi settings; product logos in the web interface.
- L6
NavGATE OS 1.0.17 · NavAP OS 1.0.13 · 11 Nov 2026
General releases: signed firmware updates from NavCloud, web interface improvements.
Security patch policy
How fast we fix vulnerabilities
High (CVSS 7.0–8.9)
Fix released within 30 days of confirmation.
Medium (CVSS 4.0–6.9)
Fixed in the next scheduled release, at the latest within 90 days.
Low (CVSS 0.1–3.9)
Fixed in a future scheduled release.
How we build firmware
Secure by design
Signed images only
NavGATE OS and NavAP OS install only firmware carrying a valid Navijin digital signature. Modified or unsigned files are rejected, locally and from the cloud.
Navijin-only connections
Devices connect only to Navijin services under navijin.com: NavCloud and the Navijin time service. No third-party clouds, telemetry or tracking.
No default passwords
The administrator creates the password at first sign-in. SSH and Telnet are not installed; management is over HTTPS and NavCloud only.
Regular maintenance
Maintenance releases are published as needed, typically monthly, with release notes on this page.
Support lifetime
Each product receives security updates for at least five years after its end-of-sale date.
Advisories
Security advisories are published on the Cybersecurity page and shown to administrators in NavCloud.
Updating devices
Three ways to update
- 01
NavCloud
Schedule upgrades by site or group in the maintenance window. NavCloud offers the latest signed release to every managed device.
- 02
Local web interface
Download the .nfw file for your exact model and upload it under System → Firmware. The device verifies the signature before installing.
- 03
Verify the file
Compare the SHA-256 checksum of the downloaded file with the value on this page before installing it.
FAQ
Questions from security teams
Do Navijin devices send data to third parties?
No. Gateways and access points connect only to Navijin services under navijin.com, such as NavCloud and the Navijin time service. Customer traffic is never sent to Navijin. Services you configure yourself, such as your own DNS or syslog server, are your choice.
How do I verify a firmware file?
Check the SHA-256 checksum listed on this page, for example with sha256sum on Linux or Get-FileHash on Windows. The device also verifies the Navijin signature before installing.
How are we notified about security fixes?
Advisories are published on the Cybersecurity page and shown in NavCloud. Partners also receive notices through the Partner Hub.
How do I report a vulnerability?
Follow the Security Vulnerability Disclosure Policy on the Cybersecurity page. We acknowledge reports within 48 hours.
Can I stay on an older release?
Yes, but we recommend the latest release. Security fixes are provided for the current release line.
Security questionnaire or audit?
Our engineers answer security questionnaires, provide release documentation and support customer audits.