diff --git a/package/libs/mbedtls/Makefile b/package/libs/mbedtls/Makefile
index fe3f14e389..5048a3cc5f 100644
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mbedtls
-PKG_VERSION:=2.28.4
+PKG_VERSION:=2.28.5
 PKG_RELEASE:=1
 PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/ARMmbed/mbedtls/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=578c4dcd15bbff3f5cd56aa07cd4f850fc733634e3d5947be4f7157d5bfd81ac
+PKG_HASH:=849e86b626e42ded6bf67197b64aa771daa54e2a7e2868dc67e1e4711959e5e3
 
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=gpl-2.0.txt
diff --git a/package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch b/package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch
index 02632cdb4b..4ad2e8c7db 100644
--- a/package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch
+++ b/package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch
@@ -33,7 +33,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  #include <windows.h>
  #else
  #include <time.h>
-@@ -3001,6 +3005,61 @@ find_parent:
+@@ -3002,6 +3006,61 @@ find_parent:
      }
  }
  
@@ -95,7 +95,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  /*
   * Check for CN match
   */
-@@ -3021,24 +3080,51 @@ static int x509_crt_check_cn(const mbedt
+@@ -3022,24 +3081,51 @@ static int x509_crt_check_cn(const mbedt
      return -1;
  }
  
@@ -158,7 +158,7 @@ Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  }
  
  /*
-@@ -3049,31 +3135,23 @@ static void x509_crt_verify_name(const m
+@@ -3050,31 +3136,23 @@ static void x509_crt_verify_name(const m
                                   uint32_t *flags)
  {
      const mbedtls_x509_name *name;
diff --git a/package/libs/mbedtls/patches/200-Implements-AES-and-GCM-with-ARMv8-Crypto-Extensions.patch b/package/libs/mbedtls/patches/200-Implements-AES-and-GCM-with-ARMv8-Crypto-Extensions.patch
index 3633b35f60..4b0106d157 100644
--- a/package/libs/mbedtls/patches/200-Implements-AES-and-GCM-with-ARMv8-Crypto-Extensions.patch
+++ b/package/libs/mbedtls/patches/200-Implements-AES-and-GCM-with-ARMv8-Crypto-Extensions.patch
@@ -126,7 +126,7 @@ Then run normal make or cmake etc.
   *      library/aria.c
   *      library/timing.c
   *      include/mbedtls/bn_mul.h
-@@ -2374,6 +2375,21 @@
+@@ -2471,6 +2472,21 @@
  #define MBEDTLS_AESNI_C
  
  /**
@@ -161,7 +161,7 @@ Then run normal make or cmake etc.
  #include "mbedtls/platform.h"
  
  #if !defined(MBEDTLS_AES_ALT)
-@@ -1040,6 +1042,11 @@ int mbedtls_aes_crypt_ecb(mbedtls_aes_co
+@@ -1076,6 +1078,11 @@ int mbedtls_aes_crypt_ecb(mbedtls_aes_co
      }
  #endif
  
@@ -170,7 +170,7 @@ Then run normal make or cmake etc.
 +	return mbedtls_armv8ce_aes_crypt_ecb( ctx, mode, input, output );
 +#endif
 +
- #if defined(MBEDTLS_PADLOCK_C) && defined(MBEDTLS_HAVE_X86)
+ #if defined(MBEDTLS_VIA_PADLOCK_HAVE_CODE)
      if (aes_padlock_ace) {
          return mbedtls_padlock_xcryptecb(ctx, mode, input, output);
 --- /dev/null
@@ -330,7 +330,7 @@ Then run normal make or cmake etc.
      base64.c
 --- a/library/gcm.c
 +++ b/library/gcm.c
-@@ -42,6 +42,10 @@
+@@ -43,6 +43,10 @@
  #include "mbedtls/aesni.h"
  #endif
  
@@ -341,7 +341,7 @@ Then run normal make or cmake etc.
  #if !defined(MBEDTLS_GCM_ALT)
  
  /* Parameter validation macros */
-@@ -80,6 +84,12 @@ static int gcm_gen_table(mbedtls_gcm_con
+@@ -81,6 +85,12 @@ static int gcm_gen_table(mbedtls_gcm_con
          return ret;
      }
  
@@ -354,7 +354,7 @@ Then run normal make or cmake etc.
      /* pack h as two 64-bits ints, big-endian */
      hi = MBEDTLS_GET_UINT32_BE(h,  0);
      lo = MBEDTLS_GET_UINT32_BE(h,  4);
-@@ -190,6 +200,11 @@ static void gcm_mult(mbedtls_gcm_context
+@@ -191,6 +201,11 @@ static void gcm_mult(mbedtls_gcm_context
      unsigned char lo, hi, rem;
      uint64_t zh, zl;
  
@@ -378,7 +378,7 @@ Then run normal make or cmake etc.
  	     blowfish.o \
 --- a/library/version_features.c
 +++ b/library/version_features.c
-@@ -624,6 +624,9 @@ static const char * const features[] = {
+@@ -636,6 +636,9 @@ static const char * const features[] = {
  #if defined(MBEDTLS_AESNI_C)
      "MBEDTLS_AESNI_C",
  #endif /* MBEDTLS_AESNI_C */
diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
index 2c492f424b..b92deff225 100644
--- a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
@@ -93,7 +93,7 @@ ramips_setup_interfaces()
 		;;
 	cudy,m1800|\
 	yuncore,ax820|\
-	zyxel,nt7101)
+	zyxel,nr7101)
 		ucidef_set_interfaces_lan_wan "lan" "wan"
 		;;
 	gnubee,gb-pc1)