MikroTik RouterOS 5.11 → 7.25
121 releases · 6 breaking changes · 47 security fixes · 45 advisories fixed
47security6breaking1deprecated436feature845fix
Vulnerabilities fixed by this upgrade
- 7.2 CVE-2025-6443 Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Aut…
- 7.5 CVE-2023-32154 Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik…
- 9.1 CVE-2023-30799 MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-a…
- 7.5 CVE-2020-20021 An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.
- 6.4 CVE-2022-45315 Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authenticated attackers to execute arbitrary code via a crafted p…
- 8.8 CVE-2022-45313 Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message.
- 9.8 CVE-2017-20149 The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by s…
- 6.5 CVE-2022-36522 Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. This vulnerability allows attackers to cause a Denial of…
- 6.5 CVE-2021-36613 Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
- 6.5 CVE-2021-36614 Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a Denial of Service (NULL pointer deref…
- 6.5 CVE-2020-20221 Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticated remote attacker can cause a Denial o…
- 6.5 CVE-2020-20262 Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /ram/pckg/security/nova/bin/ipsec process. An authenticated remote attacker can cause a Denial of…
- 6.5 CVE-2020-20249 Mikrotik RouterOs before stable 6.47 suffers from a memory corruption vulnerability in the resolver process. By sending a crafted packet, an authenticated remote attacker can cause a Denial of Serv…
- 6.5 CVE-2020-20230 Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. An authenticated remote attacker can cause a Denial of Service due to overloading the sys…
- 6.5 CVE-2020-20252 Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL po…
- 6.5 CVE-2020-20250 Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL po…
- 6.5 CVE-2020-20217 Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process. An authenticated remote attacker can cause a Denial of Se…
- 6.5 CVE-2020-20225 Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process. An authenticated remote attacker can cause a Denial of Service due to an a…
- 6.5 CVE-2020-20264 Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error.
- 6.5 CVE-2020-20266 Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. An authenticated remote attacker can cause a Denial of Service (NULL point…
- 6.5 CVE-2020-20220 Mikrotik RouterOs prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/bfd process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dere…
- 6.5 CVE-2020-20253 Mikrotik RouterOs before 6.47 (stable tree) suffers from a divison by zero vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service due to a di…
- 6.5 CVE-2020-20254 Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL poi…
- 6.5 CVE-2020-20265 Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /ram/pckg/wireless/nova/bin/wireless process. An authenticated remote attacker can cause a Denial o…
- 6.5 CVE-2020-20267 Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/resolver process. An authenticated remote attacker can cause a Denial of Service due to i…
- 6.5 CVE-2020-20247 Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute process. An authenticated remote attacker can cause a Denial of Service due…
- 7.5 CVE-2019-16160 An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.
- 7.5 CVE-2020-10364 The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write sys…
- 3.7 CVE-2019-3981 MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover the user's username and MD5 hashed pass…
- 8.8 CVE-2019-3976 RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs…
- 7.5 CVE-2019-3977 RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can tr…
- 7.5 CVE-2019-3978 RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the att…
- 7.5 CVE-2019-3979 RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router adds all A records to its DNS cache even when the records are unrelated to the…
- 6.5 CVE-2019-15055 MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to…
- 6.5 CVE-2019-13954 Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server and in som…
- 6.5 CVE-2019-13955 Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursi…
- 7.5 CVE-2019-13074 A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of uncontrolled resource mana…
- 8.1 CVE-2019-3943 MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Win…
- 7.5 CVE-2019-3924 MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients…
- 8.8 CVE-2018-1156 Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker…
- 6.5 CVE-2018-1157 Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system…
- 6.5 CVE-2018-1158 Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.
- 6.5 CVE-2018-1159 Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting.
- 9.1 CVE-2018-14847KEV MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability…
- 9.8 CVE-2018-7445KEV A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gai…
Breaking changes
- breaking dhcpv4-server - fixed removal of dynamic leases when server is removed in 7.5
- breaking vrrp - improved connection tracking synchronization protocol (CTSYNC), the new protocol is incompatible with previous RouterOS versions with "sync-connection-tracking=yes" in 7.5
- breaking wifiwave2 - fixed WPA3-PSK authentication incompatibility with certain vendor and model devices in 7.3.1
- breaking ipv6 - fixed address becoming invalid when interface was removed from bridge/mesh in 6.38.7
- breaking certificates - fixed crash when crl is removed while it is being fetched in 6.37.4
- breaking removed 10/100 half duplex from autonegotiation advertisement on CCR in 6.10
Security changes
- security system - improve stability (includes CVE-2026-84411) in 7.23.8
- security crypto - improve stability (CVE-2026-67278) in 7.23.6
- security user - improve failed login delay logic (CVE-2026-16347) in 7.23.6
- security Fixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to… in 7.23.4
- security Fixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra… in 7.23.4
- security Fixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send… in 7.23.4
- security Fixes CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig… in 7.23.4
- security Fixes CVE-2026-67281: RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.… in 7.23.4
- security wifiwave2 - improve protections from denial-of-service attacks on WPA3 in 7.8
- security Fixes CVE-2022-45315: Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authenticated attackers to execute arbitrary code via a crafted p… in 7.6
- security firewall - fixed IRC NAT helper (CVE-2022-2663) in 7.6
- security Fixes CVE-2022-45313: Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message. in 7.5
- security system - improve stability (includes CVE-2026-84411) in 6.49.23
- security system - improve stability (includes CVE-2026-67281) in 6.49.22
- security Fixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to… in 6.49.21
- security Fixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra… in 6.49.21
- security Fixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send… in 6.49.21
- security security - allow only "http:" and "https:" schemas in relevant dst fields in 6.49.19
- security Fixes CVE-2024-54772: An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18.… in 6.49.18
- security Fixes CVE-2023-30800: The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTT… in 6.49.10
- security !) ipv6 - fixed DNS server processing by IPv6/ND services (CVE-2023-32154) in 6.49.8
- security firewall - fixed IRC NAT helper (CVE-2022-2663) in 6.49.8
- security !) ipv6 - fixed DNS server processing by IPv6/ND services (CVE-2023-32154) in 6.48.7
- security firewall - fixed IRC NAT helper (CVE-2022-2663) in 6.48.7
- security MAJOR CHANGES IN v6.47.10: ---------------------- !) wireless - fixed all affecting 'FragAttacks' vulnerabilities (CVE-2020-24587, CVE-2020-24588, CVE-2020-26144, CVE-2020-26146, CVE-2020-26147); ---------------------- in 6.47.10
- security hotspot - fixed special character parsing in "target" variable (CVE-2021-3014) in 6.47.9
- security smb - fixed possible memory leak (CVE-2020-11881) in 6.46.7
- security wireless - fixed potential wireless driver issue related to CVE-2020-3702 in 6.46.7
- security winbox - made "none" the default value for "Security Profile" parameter when creating a new "Wirelees->Connect list" entry in 6.45.9
- security security - fixed vulnerability for routers with default password (limited to Wireless Wire), admin could login on startup with empty password before default configuration script was fully loaded in 6.45.8
- security Fixes CVE-2020-20221: Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticated remote attacker can cause a Denial o… in 6.44.6
- security MAJOR CHANGES IN v6.44.6: ---------------------- !) package - accept only packages with original filenames (CVE-2019-3976); !) package - improved package signature verification (CVE-2019-3977); !) security - fixed improper handling of DNS responses (CVE-2019-3978, CVE-2019-3979);… in 6.44.6
- security system - accept only valid string for "name" parameter in "disk" menu (CVE-2019-15055) in 6.44.6
- security MAJOR CHANGES IN v6.44.5: ---------------------- !) security - fixed vulnerabilities CVE-2019-13954, CVE-2019-13955; !) security - fixed vulnerabilities CVE-2019-11477, CVE-2019-11478, CVE-2019-11479; !) security - fixed vulnerability CVE-2019-13074; ---------------------- in 6.44.5
- security conntrack - fixed GRE protocol packet connection-state matching (CVE-2014-8160) in 6.44.5
- security ovpn - added "verify-server-certificate" parameter for OVPN client (CVE-2018-10066) in 6.44.5
- security www - improved client-initiated renegotiation within the SSL and TLS protocols (CVE-2011-1473) in 6.44.5
- security Fixes CVE-2019-3924: MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients… in 6.42.12
- security MAJOR CHANGES IN v6.40.9: ---------------------- !) security - fixed vulnerabilities CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159; ---------------------- in 6.40.9
- security winbox - hide "wps-mode" & "security-profile" in wireless nv2 mode in 6.38.7
- security Fixes CVE-2017-20149: The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by s… in 6.37.5
- security webfig - added extra protection against XSS exploits in 6.37.4
- security wireless - show comment on "security-profile" if it is set in 6.37.4
- security ntp - fixed vulnerabilities in 6.25
- security ntp - fixed vulnerabilities in 6.24
- security ssh - fixed denial of service in 6.3
- security ssh - fixed denial of service in 5.26
Deprecations
- deprecated route - removed deprecated "/routing/route/rule" menu in 7.21.5
Every release in between
fixbridge - disable DHCP snooping ip binding table (introduced in v7.24)
otherbridge - enable vlan hardware offloading on hAP be3 Media device
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.24.3)
fixconsole - fix scheduler scripts with the default start date and time not being triggered (introduced in v7.24)
otherethernet - improve stability on hAP be3 Media device
otherlte - improve stability for MBIM modem mode switch
fixospf - fix unset interface template parameters not being applied to interfaces
fixpoe-out - fix loss of PoE-out capability on CRS328-24P-4S+ after a reboot
othersystem - improve stability
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.24.3)
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.23.6)
otherethernet - improved stability when forcing unsupported link speed
fixipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder
fixospf - fix unset interface template parameters not being applied to interfaces
fixquickset - fix the WAN interface being selected incorrectly
securitysystem - improve stability (includes CVE-2026-84411)
othersystem - stop the flash configuration store from growing on dynamic configuration changes
fixwifi - fix malformed management frame information elements advertising availability of multiple 6GHz APs
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.23.6)
otherbgp - improve stability
featurecertificate - add "SSL.com Root Certification Authority ECC" to built-in root certificate authorities store
featurecertificate - allow importing a cross-signed certificate without replacing the existing one
othercertificate - refactor certificate internal processes
othercertificate - remove "GoDaddy Class 2 CA" from built-in root certificate authorities store
otherconsole - improve stability
securitycrypto - improve stability (CVE-2026-67278)
fixipsec - fix duplicate connections on IKEv2 retransmissions
otheripsec - improve stability
fixleds - fix LEDs set to interface status staying off when the interface is active
otherppp - improve stability
featureptp - add manual configuration of PTP message intervals and per-port enabling and disabling
fixptp - fix PTP offset instability under heavy background multicast traffic
fixptp - fix PTP timestamps showing the wrong time on CRS510
othersfp - improve QSFP-DD breakout link establishing to NVIDIA DGX Spark and other devices
othersystem - improve stability
securityuser - improve failed login delay logic (CVE-2026-16347)
otherwifi - update radio regulatory information
otherwww - improve stability
fixdhcp - fixed IPv6 DHCP functionality (introduced in v7.23.4)
securityFixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to…
securityFixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra…
securityFixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send…
securityFixes CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig…
securityFixes CVE-2026-67281: RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.…
fixbgp - fix BGP link-local nexthops unreachable over a VRF and a crash when disabling an unnumbered connection
otherbtest - improve stability
fixcertificate - fix changing the built-in trust store setting (introduced in 7.22.2)
otherconsole - improve stability
otherdhcp - improve stability of DHCP handling
otherdisk - improve stability of the SMB server
otherfetch - improve stability of the TFTP client
fixipsec - fixed expired SA handling to prevent "no such item" errors during listing
otheripsec - improve IKE handshake stability
otherleds - improved interface stats activity for devices with Marvell Prestera switch chip
otherlte - removed extra restart after firmware upgrade for EC200A-EU modem
fixlte - fix the RG650E-EU modem not bringing link up after a firmware update
featureping - add parameter checks for arp ping
othersnmp - properly validate password length when applying configuration
otherssh - refactor SSH internal processes and improved system stability
othersystem - improve handling of invalid SSL/TLS requests
othersystem - improve stability
fixtunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22)
otherwebfig - improve stability
otherwifi - updated radio regulatory information
fixwinbox - fix the "addresses" spelling in read-only fields
fixwireguard - fixed peer Tx/Rx counters
otherwireguard - generate port number when specified as zero
otherwireguard - reinitialize socket on VRF change
otherwww - improve stability
fixconsole - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal
fixethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22)
fixvrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip
fixbfd - fixed delay on session print
fixbgp - fixed advertisement print handling by "dst" when destination is in VRF
fixbgp - fixed IPv6 End-of-Route processing
otherbgp - improved stability on MP (multiprotocol) parsing
fixbridge - fixed dynamic VLAN update for wifi interfaces
fixbridge - fixed stability issue when using DHCPv4 snooping
othercloud - cloud backup file management now requires "policy" policy
fixconsole - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal
fixcontainer - fixed missing config.json issue when upgrading from version 7.20.8 or older
featuredisk - avoid reading SCSI stats all the time to allow disks to go to sleep
fixethernet - fixed stability issue with TSO on Alpine CPUs
otherethernet - improved system stability on devices with Alpine CPUs
otheripv6 - do not disable IPv6 FastPath when Traffic Flow is enabled
featureisis - allow to configure metric-type
fixisis - fixed missing "l2.lsp-refresh-interval" parameter
otherl3hw - improved system stability on device shutdown/reboot
fixlte - fixed cases where EC25-EU and EG25-G boards would receive packets with missing last 4 bytes
fixlte - fixed crash on LTE passthrough interface deactivation
fixospf - fixed interface passive flag update in WinBox
fixroute - fixed static route flag handling by WinBox on disable
deprecatedroute - removed deprecated "/routing/route/rule" menu
fixswitch - fixed issue with MAC table for RB2011 (introduced in v7.21)
fixswitch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs
otherswitch - increase "ingress-rate" and "egress-rate" maximum value to 400G
othertimezone - updated timezone information from "tzdata2026b" release
otherupgrade - prevent package scheduling from interfering with the upgrade feature
fixvxlan - fixed fast-path when using "checksum=no" (introduced in v7.20)
featurewinbox - do not pre-fill "Allowed Address" and "Client Allowed Address" with "::/0" when adding new WireGuard Peer
fixbgp - fixed stability issue when non-existent output select-chain was specified
featurebgp-vpn - allow modifying scopes with routing filters
fixbgp-vpn - fixed non-working import filter after reboot
otherbgp-vpn - use target scope for imported route
fixbridge - fixed missing dynamic "switch-cpu" VLAN entry in WiFi setup
fixbridge - fixed performance regression in complex setups with vlan-filtering (introduced in v7.20)
otherconsole - removed the "reset" command from shared settings menus (IP/IPv6/Bridge/L3HW/Neighbor-Discovery/Connection-Tracking)
fixcontainer - fixed issue where the container might not start after upgrading if root-dir was not set
othercontainer - improved error message if a container fails to start
fixdefconf - fixed L009 configuration (introduced in v7.21)
fixethernet - fixed false excessive broadcast warning (introduced in v7.20)
otherfirewall - improved system stability
otheripsec - improved aes256-ctr stability on L009
otheripsec - removed modp8192 proposal on MIPS architectures
otheripv6,ra - use received prefix when RA on-link flag is 0
otherisis - improved stability with fragmented CSNP
otherl2tp - improved system stability on TILE architecture
fixl3hw - fixed missing VLAN counters after reboot (introduced in v7.21)
fixl3hw - fixed stability issue (introduced in v7.21)
fixleds - fixed default LED configuration for CCR2004-1G-12S+2XS
otherlog - do not provide non-existent logging topics for configuration
fixlte - fixed framed route support for the first APN
fixlte - fixed missing automatic redial when cellular connectivity is lost for R11e-LTE
fixlte - fixed user set MTU not applied to LTE interface
fixospf - fixed typos in log messages
fixovpn - fixed OVPN push routes
fixpoe-out - fixed rare PoE-Out firmware upgrade failure on CRS354-48P-4S+2Q+
featureptp - allow manual domain configuration for 802.1AS profile
fixqos-hw - fixed "offline" tx-manager ability to queue at least one packet (introduced in v7.21)
featureroute - added SLAAC route redistribution for IPv6 capable routing protocols
fixrouterboard - fixed applying settings via WinBox on devices with fixed CPU frequency
featurerouting-filter - added possibility to match SLAAC and bgp-mpls-vpn route types
fixswitch - fixed stability issue when changing bridge multicast-router property on CRS1xx/2xx (introduced in v7.19)
featuresystem - added FCC Part 15 Compliance label to "System/Regulatory" menu
fixuser - properly apply login delay (introduced in v7.20)
fixwifi-mediatek - fixed communication issues on 802.11ax access points with Intel clients
fixwifi-mediatek - fixed HE capabilities IE on 2GHz band
fixwinbox - fixed "Remote AS" setting under the "Routing/BGP/Connections" menu
fixwinbox - fixed "Src/Dst Address Type" under the "IP/Firewall/NAT" menu
fixwinbox - fixed L3HW default value for VLAN interface (introduced in v7.21)
+16 more items in the release notesfixbgp - fixed route refresh subcode 0 warning
featurebgp - implement revised input error handling per RFC 7606
fixbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20.7)
fixcontainer - fixed nftables/iptables not working with "Message too long" error
fixhealth - fixed fan and PSU state logging for MIPSBE devices
otherpoe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces)
fixpoe-out - fixed PSU state recovery upon unplug/replug on CRS320
featureppp - added initial support for BG770A-GL modem firmware update
otherroute - prevent creating routing tables with the same name
fixrouting-filter - fixed num-set matcher
fixsfp - fixed sfp-ignore-rx-loss parameter for RB760iGS
fixsnmp - fixed handling of the script "dont-require-permissions" parameter when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput
fixsnmp - fixed permission error reporting when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput (introduced in v7.20.7)
fixsnmp - fixed script "run-count" update after execution
fixsystem - fixed rare partial loss of RouterOS configuration
otheruser-manager - properly release database backup file after backup creation
fixw60g - fixed possible memory leak when an interface is disabled
otherzerotier - improved route removal
fixbgp - fixed l2vpn-cisco decoding (introduced in v7.20)
fixbgp - fixed occasional corruption of MPLS labels in BGP VPN update messages
fixbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20)
fixbridge - improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20)
otherbth - make user private-key sensitive
fixconsole - fixed empty output in route menus when using "print where gateway"
otherconsole - updated copyright notice
otherfirewall - clear relevant masqueraded connection tracking entries on IP address change
otheripv6 - initialize RA receiving when enabled and without any other IPv6 configuration
fixlog - fixed memory leak
fixlte - fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20)
fixlte - fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17
fixovpn - fixed OVPN server handling on reboot (introduced in v7.20)
otherovpn - improved system stability when using cipher=blowfish128
fixsfp - fixed "sfp-tx-fault" state indication for CRS520-4XS-16XQ
fixsfp - fixed missing link up/down notifies
fixswitch - fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches
othersystem - detect policy mismatch sooner if script is executed internally by some other service
fixups - fixed board hibernation shutdown
featurewifi-mediatek - added Superchannel regulatory profile
otherbridge - improved system stability with IGMP snooping
otherethernet - improved performance for hEX Refresh and hEX S (2025)
otherike2 - improved system stability
fixleds - fixed signal strength LEDs for Cube 60G ac
featurelog - added VRF support for remote logging
featurelog - establish a new connection to the remote log server when action settings are edited (e.g. after changing the src-address property)
fixlog - fixed memory leak when a connection to remote TCP log server failed
fixlog - fixed unsent message retransmit to correct endpoints (introduced in v7.18)
otherlog - randomize source port when using remote logging with src-address specified
fixlte - fixed wrong subnet mask set to Chateau 5G R17 ax LTE interface
fixmac-server - fixed interface-list change behavior
featurepoe-out - added "poe-in" detection for 802.3at poe-out capable ports
otherpoe-out - firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces)
fixpoe-out - fixed "low-voltage" LLDP deny for RB5009 and RB960 in specific voltage/power-source combinations
fixpoe-out - fixed missing error status report in rare cases for 802.3at
fixrouterboot - fixed load of other kernels (e.g. OpenWrt) on NAND-less boards with MT762x, IPQ40xx, QCA955x and QCA953x CPUs ("/system routerboard upgrade" required)
fixsfp - fixed the I2C clock frequency for the hEX S (2025) to prevent EEPROM read issues with GPON modules
fixswitch - fixed switch name for CRS418
fixswitch - improved system stability after switch reset while bonding interfaces are active (introduced in v7.18)
featuretraffic-flow - added support for IPv6 packet sampling
fixtraffic-flow - fixed flow reports when using IPv6 and packet sampling (introduced in v7.18)
fixw60g - fixed disconnect issue (introduced in v7.19.4)
featurewinbox - allow selecting bonding interface under "Switch/Rule" menu
otherwinbox - use "auto" as default value for VXLAN "Don't Fragment" property
fixconsole - fixed issue with file-name completion (introduced in v7.18)
fixcontainer - fixed repository name handling to prevent redirect issues when basic authentication is used
fixlte - additional fixes for eSIM management support
otherlte - AT modems, improved redialing when modem lost connectivity without notifying host about APN status change
fixnetinstall - fixed socket reset (introduced in v7.18)
fixqueue - fixed system failure when CAKE kind queue was configured but queue type definition does not exist anymore (introduced in v7.18)
otherwifi - improved stability for wifi interfaces
otherwinbox - improve graphing efficiency when communicating with WinBox
fixdevice-mode - do not allow changing CPU frequency if "routerboard" is not allowed by device mode (introduced in v7.17)
fixdevice-mode - fixed feature and mode update via power-reset on PPC devices
fixdisk - fixed showing free space on tmpfs (introduced in v7.17)
fixdisk - improved system stability when SMB interface list is used (introduced in v7.17)
otherdns - do not show warning messages for DNS static entries when they are not needed
fixhotspot - fixed an issue where extra "flash/" is added to html-directory for devices with flash folders (introduced in v7.17)
othersfp - improved system stability with some GPON modules for CCR2004 and CCR2116 devices
fixsmb - fixed connection issues with clients using older SMB versions (introduced in v7.17)
fixswitch - fixed dynamic switch rules created by dot1x server (introduced in v7.17)
fixsystem - fixed a potential memory leak that occurred when resetting states after an error
othercertificate - do not download CRL if there is not enough free RAM
fixcertificate - fixed handling of capsman-cap certificates (introduced in v7.16)
featuredhcpv4-server/relay - added additional error messages for DHCP servers and relays
fixdns - fixed lookup order for static DNS entries (introduced in v7.16.1)
otherethernet - improved linking after reboot for hAP ax lite devices ("/system routerboard upgrade" required)
othergps - changed default GPS antenna setting for LtAP mini with internal LTE/GPS combo antenna
fixleds - fixed bogus argument for "leds" property (introduced in v7.16)
fixleds - fixed PoE-in LEDs for CRS318-1Fi-15Fr-2S device
othermodem - KNOT BG77 modem, improved handling of modem unexpected restarts
fixroute - fixed possible issue with inactive routes after reboot (introduced in v7.16)
otherrouterboot - improved stability for IPQ8072 and IPQ6010 when flash-boot is used ("/system routerboard upgrade" required)
fixlte - fixed possible crash when enabling/disabling config-less modem interface
fixlte - fixed R11e-LTE no traffic flow when modem with older firmware version is used
otherrouterboard - improved Etherboot stability for CRS320-8P-8B-4S+ device ("/system routerboard upgrade" required)
fixssh - fixed unsupported user SSH public key import (introduced in v7.15)
otherbgp - correctly synchronize input.accept-nlri address list
otherbridge - use default "edge=auto" for dynamically bridged interfaces (PPP, VPLS, WDS)
otherdisk - improved system stability
fixfetch - fixed slow throughput due to "raw" logging which occurred even when not listening to the topic (introduced in v7.13)
fixqueue - improved system stability (introduced in v7.6)
featurewifi-qcom - added configuration.distance setting to enable operation over multi-kilometer distances (CLI only)
fixbridge - fixed MLAG connection after peer-link flap (introduced in v7.13)
fixbridge - fixed packet forwarding after changing HW offloaded bridge interface settings in certain cases (introduced in v7.13)
fixdns - do not close connection with DoH server after query execution (introduced in v7.13.3)
fixleds - fixed modem signal strength for RBSXTR&R11e-LTE (introduced in v7.13)
othersms - increased SMS read timeout
otherwifi-qcom - improved memory allocating process
otherwifi-qcom - improved regulatory compliance for L11, L22 devices
otherwifi-qcom - improved system stability for L11, L22 devices
other(factory only release)
other(factory only release)
fixwifiwave2 - fixed interface hangs on IPQ6010-based boards (introduced in v7.9)
otherrouterboard - improved RouterBOOT stability for Alpine CPUs ("/system routerboard upgrade" required)
othersfp - improved SFP interface handling for RB4011 device
fixbgp - fixed setting of "default-prepend" parameter
fixbridge - fixed adding disabled MSTI
fixbridge - fixed DHCP packet flow when using DHCP snooping, HW offloading and "use-ip-firewall"
fixbridge - fixed possible DHCP packet corruption when using DHCP snooping
fixbridge - fixed PVID warning typo
fixcertificate - fixed export of a certificate when the last line of the certificate is exactly 64 bytes long
fixcertificate - fixed PBES2 certificate import
featureconsole - added "as-string" parameter to the ":execute" command
featurecontainer - added authentication option for registry (CLI only)
fixcontainer - fixed ".type" file ownership
fixcontainer - fixed file ownership after system upgrade for containers running on internal disk
featuredns - added configurable DoH concurrent query limitation parameters
featureike2 - added support for "address", "key-id" and "dn" for Remote ID matching (CLI only)
featureipsec - added support for "Framed-Route" RADIUS attribute support
featureipv6 - added "pref64" option configuration for RA
featurel3hw - added destination MAC address check for offloaded FastTrack connections
featurelte - added AT support for Telit LE910C4 in MBIM mode
featureovpn - added AES-GCM and multicore encryption support
featurepoe - added LLDP power management support for 802.3at PSE
featuresniffer - added additional filtering parameters
featuretorch - allow "without-paging" parameter for Torch
featurevxlan - added "dont-fragment" setting that allows managing fragmentation
featurevxlan - added "max-fdb-size" parameter
featurevxlan - added FastPath support
featurewebfig - allow setting numeric values in time interval fields
featurewifiwave2 - added wireless sniffer tool to capture wireless transmissions (CLI only)
featurewifiwave2 - implement 802.11w management protection SA Query procedures
securitywifiwave2 - improve protections from denial-of-service attacks on WPA3
featurewinbox - added "Connect" button under "WifiWave2/Scan" menu
featurewinbox - added "Disable/Enable" buttons under "WifiWave2" menu
featurewinbox - added "Match Subdomain" parameter under "IP/DNS/Static" menu
featurewinbox - added "Provision" button under "WifiWave2" menu
featurewinbox - added "Start On Boot" checkbox under "Container" menu
featurewinbox - added "Tx Rate" and "Rx Rate" columns under "WifiWave2/Registration" menu
featurewinbox - added missing properties when setting "Use DoH Server"
featurewinbox - added missing WifiWave2 related parameters under "WifiWave2" menu
featurewinbox - added support for manual RAM file system (TMPFS) creation under "System/Disk" menu
featurewinbox - added Type "https-get" parameter under "Tools/Netwatch" menu
featurewinbox - allow selecting bridge for static entries under "Bridge/MDB" menu
featurex86 - added support for TP-Link TG-3468
+101 more items in the release notesfeaturebgp - added comment functionality for BGP VPN (CLI only)
featurebluetooth - added unique advertise message filtering
featurebridge - added support for static MDB entries
featurediscovery - added "discovered-by" parameter to indicate which protocol discovered the neighbor
featurediscovery - added "mode" parameter for discovery configuration
featuredisk - added support for manual RAM file system (TMPFS) creation (CLI only)
featurefirewall - added "set-priority" option for IPv6 mangle firewall
featurehotspot - added "install-hotspot-queue" parameter to control dynamic queue creation
featureike2 - added support for ChaChaPoly1305 encryption
featureike2 - added support for DH Group 31 (EC25519) (CLI only)
featureinterface - do not allow adding invalid "veth" interfaces
featureipsec - added "current-address" parameter for peers with DNS address
featureipsec - added hardware acceleration support for IPQ-6010
featureipsec - added support for AVX optimized SHA acceleration
featurel2tp - added VRF support for L2TP Ether interfaces
featurelte - added AT channel support for Telit FN990
featurelte - added CA information in 5G mode
featuremodem - added USB tethering support for Google Pixel 7 devices
featurempls - added VPLS LDP information in remote/local-mappings
featurenetinstall - added "-i " parameter for Netinstall (CLI Linux)
featurenetwatch - added support for "https-get" type (CLI only)
featureovpn - added "CBC" postfix to AES cipher names
featureovpn - added "route-nopull" option for client side
featureovpn - added hardware acceleration support for IPQ-6010
featureovpn - added support for IPv6 tunneling
featureport - added serial port support for Telit FN990 modem
featuresfp - added 2.5G SFP module support for RB5009
featuresfp - allow usage of "10G Base-LR" mode for XS+31LC10D module
featuresnmp - added support for "lldpRemLocalPortNum" OID's
featuressh - added support for Ed25519 key exchange
featuressh - do not allow SHA1 usage with strong crypto enabled
featuresupout - added MSTI and mst-override monitor for bridge MSTP
featuresupout - added missing IPv6 firewall sections
featuresystem - allow up to 4GB of RAM allocation per process on x86, ARM64 and TILE
featuretunnels - added VRF support for EoIP, IPIP and GRE tunnels
featurevxlan - added "local-address" parameter support
featurevxlan - added VRF support
featurewifiwave2 - added "datapath" settings to configure data forwarding for an interface (CLI only)
featurewifiwave2 - added "ft-preserve-vlanid" parameter to control whether to change VLAN ID after FT
featurewifiwave2 - added "provisioning" menu to automatically assign interface configurations to radios (CLI only)
+171 more items in the release notessecurityFixes CVE-2022-45315: Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authenticated attackers to execute arbitrary code via a crafted p…
featurebgp - added support for BGP advertisement displaying (CLI only)
featurecontainer - added "start-on-boot" parameter for automatic container startup
featurecontainer - allow changing container related parameters while it is running
featuredns - added "match-subdomain" option for static entries (CLI only)
featureethernet - added "5Gbps" option for speed setting
featurefirewall - added "src/dst-address-type" parameter under "IPv6/Firewall/Mangle" menu
securityfirewall - fixed IRC NAT helper (CVE-2022-2663)
featureinterface - added warning when interface has configured "mtu" higher than "l2mtu"
featureipsec - added "invalid-packets" counter for Installed SA's menu
featurel3hw - added "l3hw-settings" sub menu under the switch menu
featurel3hw - added support for IPv6 route offloading (disabled by default)
featurelte - added interface name in MTU debug logging message
featurelte - added periodic IPv6 RS to trigger IPv6 adress acquisition for non-MBIM modems
featurelte - added support for Neoway N75-EA
featurelte - added support to perform FOTA upgrade from local file for EG12-EA, EG18-EA, RG502Q-AE, EG06-A, EP06-A modems
featuremacsec - added configuration support with VLAN, ARP, DHCP and bridge tagging/untagging
featuremacsec - added logging support with "debug" and "dot1x" topics
featuremacsec - added support for MTU and L2MTU
featureospf - added SHA hashing for authentication
featureovpn - added IPv6 support
featureovpn - added VRF support for client
featureqsfp - added interface temperature warnings and shutdown
featureserial - added support for newer PL2303 serial controllers
featuresms - added "status-report-request" parameter for "send" command
featuresstp - added VRF support for client
featuresupout - added tr069-client section
featuretr069-client - do not allow ":" symbols in username
featureuser-manager - added "comment" parameter for batch user creation
featureuser-manager - added support for multiple accounting sessions
featureuser-manager - added variables to print profile name and end time in voucher templates
featureuser-manager - allow specifying router's address as subnet
featurevxlan - added IPv6 support for remote VTEPs (only IPv4 or IPv6 will be used at the same time, use "vteps-ip-version" property on VXLAN interface to change the version)
featurewinbox - added "Active" prefix for current remote and local session ID fields for L2TP-Ether interfaces
featurewinbox - added "address-list" parameter under "IP/DNS/Static" menu
featurewinbox - added "File Name" option for "Load Config" parameter under "System/SwOS" menu
featurewinbox - added icon for TR069-client menu
featurewinbox - added MACsec support
featurewinbox - added quick filtering option for route list
featurewinbox - added "Rapid Commit" parameter support under "IPv6/DHCP-Server" menu
+118 more items in the release notessecurityFixes CVE-2022-45313: Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message.
fixbgp - fixed remote refuse capability options, max prefix limit errors and administrative stop
fixbridge - fixed "new-priority" value validation for NAT rules
featurecapsman - added randomized range option for "reselect-interval" parameter (CLI only)
fixcertificate - fixed handling of empty AKID by SCEP client
fixconsole - fixed automatic command completion with keypress
featurecontainer - added support for running Docker (TM) containers on ARM, ARM64 and x86 (containers created before v7.4 must be recreated)
fixdefconf - fixed loading of default configuration on RB4011 with WifiWave2 package enabled
breakingdhcpv4-server - fixed removal of dynamic leases when server is removed
fixdhcpv6-relay - fixed relay forwarding (introduced in v7.1.5)
featuredns - added "address-list" parameter for static DNS entries (CLI only)
featuredns - added "match-subdomain" option for static entries (CLI only)
featurefirewall - added support for RTSP helper
fixhealth - fixed "temperature" and "power-consumption" readings on RB1100x4
fixhostpot - fixed Walled Garden functionality for HTTPS sites
featureike2 - allow sending certificate chain as initiator
fixinterface - fixed default interface naming on RB1100x2
fixl3hw - fixed HW offloaded NAT
fixleds - fixed default LED configuration for RBwsAP-5Hac2nD
fixleds - fixed wireless LED functionality on LHGG
featurelte - added at-chat and NMEA port support for Simcom modems, USB composition (device id - 0x9003)
featurelte - added at-chat support for Simcom modems, USB composition (device id - 0x9005)
featurelte - added "SIM not inserted" and "SIM failure" messages to "status" and "monitor" commands for AT modems
fixlte - fixed AT channel for Sierra Wireless modems with device ID 0x9091
fixlte - fixed LTE interface presence for Telit LN940
fixlte - fixed UDP performance on MMIPS devices
fixnetinstall - fixed Netinstall procedure for ARM devices
fixntp - fixed NTP server when "use-local-clock" is used
fixospf - fixed handling of external forwarding address
featureport - added support for D-Link DWM-222 in serial/PPP mode (device id - 0xac01/0x7e3d)
featureport - added support for Huawei/ZTE K5006z in serial/PPP mode (device id - 0x1017/0x1018)
featurerouterboard - added "reset-button" script feature for TILE devices
featuressh - added AES support for PEM decryption
featureswos - enabled SwitchOS support for CRS310-1G-5S-4S+
featuretraceroute - added "do-not-fragment" parameter support (CLI only)
featurevrrp - added "sync-connection-tracking" compatibility with preemption-mode
breakingvrrp - improved connection tracking synchronization protocol (CTSYNC), the new protocol is incompatible with previous RouterOS versions with "sync-connection-tracking=yes"
featurewebfig - allow to specify NTP server as domain name
featurewifiwave2 - added "sae-pwe" parameter with hash-to-element mechanism for SAE PWE derivation
featurewifiwave2 - added support for 802.11k
+66 more items in the release notesfixfirewall - fixed "in-interface-list" matcher when VRF is used
othernetwatch - changed ICMP default packet loss fail threshold to 85%
fixnetwatch - fixed usage of "timeout" value in simple mode
fixsfp - fixed speed mode setting after reinserting SFP module on CRS328-4C-20S-4S+
othersfp - improved combo SFP ports initialization handling on CRS312-4C+8XG, CRS328-4C-20S-4S+
fixwinbox - fixed "Type" and "Value" field displaying under "System/Health" sub-menu's
fixrb3011 - fixed RB3011 going into a reboot loop when the SFP module is present (introduced in v7.3)
breakingwifiwave2 - fixed WPA3-PSK authentication incompatibility with certain vendor and model devices
fixsystem - fixed RouterOS bootup when wifiwave2 package is installed (introduced in v7.2.2)
fixroute - fixed "table" menu emptying after RouterOS upgrade
securitysystem - improve stability (includes CVE-2026-84411)
securitysystem - improve stability (includes CVE-2026-67281)
securityFixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to…
securityFixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra…
securityFixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send…
otherbtest - improve stability
otherconsole - improve stability
otherfetch - improve stability of the TFTP client
othersnmp - improve stability of SNMP
otherssh - refactor SSH internal processes and improved system stability
othersystem - improve stability
othersystem - updated certificate for Windows executable signing
othertimezone - updated timezone information from "tzdata2026b" release
otherconsole - updated copyright notice
otherethernet - improved system stability for RB912, RB911 devices
fixmac-server - fixed configuration change for "interface-list" property
otherrouterboard - do not show "upgrade-firmware" if available installation is older than minimal supported one
otherconsole - updated copyright notice
featurelte - added support for R11e-LTE6 v039 firmware release
securitysecurity - allow only "http:" and "https:" schemas in relevant dst fields
fixsystem - fixed v6 to v7 upgrade from separate packages
othersystem - improved upgrade procedure reliability
otherupgrade - the upgrade, testing, and development channels now direct to the latest long-term version of RouterOS v7
securityFixes CVE-2024-54772: An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18.…
otherconsole - updated copyright notice
otherfetch - improved system stability when using TFTP
otherhotspot - properly escape all reserved URI characters
featureradius - added "require-message-auth" option that requires "Message-Authenticator" in received Access-Accept/Challenge/Reject messages
otherradius - include "Message-Authenticator" in any RADIUS communication messages besides accounting for all services
featuresystem - added "shutdown" parameter for reset-configuration (CLI only)
fixsystem - fixed false log message about successful package installation
fixsystem - fixed v6 to v7 upgrade from separate packages
othersystem - improved system stability
othersystem - set flash-boot mode as "boot-device" after system reset initiated by reset button ("/system routerboard upgrade" required)
othersystem - set flash-boot mode as "boot-device" after system reset initiated from software
otheruser - improved authentication procedure when RADIUS is not used
featurewireless - allow to set Canada2 country profile when locked with US lock package for CubeG device
fixwireless - fixed antenna gain for SXT5ac device
fixdefconf - fixed firewall rule for IPv6 UDP traceroute
securityFixes CVE-2023-30800: The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTT…
otherwww - improved service stability when receiving malformed packets
security!) ipv6 - fixed DNS server processing by IPv6/ND services (CVE-2023-32154)
otherconsole - updated copyright notice
fixdefconf - fixed invalid default password setting after configuration reset for 60GHz interface (introduced in v6.49.5)
securityfirewall - fixed IRC NAT helper (CVE-2022-2663)
otherhotspot - improved stability when receiving bogus packets
fixsmb - fixed SMB2 file list reporting
security!) ipv6 - fixed DNS server processing by IPv6/ND services (CVE-2023-32154)
othercapsman - improved stability when running background scan on CAP
otherconsole - updated copyright notice
securityfirewall - fixed IRC NAT helper (CVE-2022-2663)
otherhotspot - improved stability when receiving bogus packets
fixsmb - fixed SMB2 file list reporting
fixsnmp - fixed IPsec-SA byte and packet counter reporting
othercertificate - improved stability when sending bogus SCEP message
otherquickset - use 5GHz interface's country for "Home AP Dual" configuration
othersystem - improved system stability if device is upgraded from RouterOS and/or RouterBOOT v6.41.4 or older
featureupgrade - added new "upgrade" channel for upgrades between major versions
featurewinbox - do not allow to add/remove W60G interfaces
featurewireless - added U-NII-2 support for US and Canada country profiles for cAP ac XL and QRT 5 ac
featurebranding - properly clean up old branding files before installing a new one
fixcrs3xx - fixed default MAC address calculation on management Ethernet for CRS312, CRS326-24S+2Q+ and CRS354 devices
othergps - improved interface monitoring
otherhealth - improved temperature reporting
otherike2 - check if TS is still valid after obtaining SPI
otheripsec - improved SA update by SPI
othernetinstall - require Netinstall version to be the same or newer as "factory-software"
otherpoe - update PoE firmware only on devices that supports it
otherppp - improved stability when receiving bogus response on modem channel
otherqsfp - improved system stability when setting unsupported link rates
featuresfp - added "sfp-rate-select" setting (CLI only)
othersfp - improved SFP, SFP+, SFP28 and QSFP+ interface stability for CRS3xx and CCR2004 devices
othersfp28 - changed FEC auto mode to disabled
otherw60g - limit power output when using region EU to match EN302567 on nRAY
otherw60g - use EU region by default
featurewinbox - added "name" and "file-name" parameter when importing and exporting certificates
featurewinbox - allow setting MCS (24-31) to 4x4 Wireless interfaces
featurewinbox - do not allow to set empty "init-string" field under "System/GPS" menu
otherwinbox - do not show "GPS antenna" selection for devices without selection support
otherwinbox - show "System/Health/Settings" only on boards that have configurable values
otherwinbox - show "current-channel" column by default for CAP interfaces
featurewireless - added U-NII-2 support for US and Canada country profiles for hAP ac lite
securityMAJOR CHANGES IN v6.47.10: ---------------------- !) wireless - fixed all affecting 'FragAttacks' vulnerabilities (CVE-2020-24587, CVE-2020-24588, CVE-2020-26144, CVE-2020-26146, CVE-2020-26147); ----------------------
otherbonding - improved system stability when disabling/enabling bonding ports
featurebranding - added option to upload custom files (newly generated branding package required)
othercapsman - use proper units for "ap-tx-limit" and "client-tx-limit" parameters
otherconsole - do not clear environment values if any global variable is set
otherconsole - require "write+ftp" permissions for exporting configuration to file
otherconsole - updated copyright notice
featurecrs3xx - added "/system swos" menu for CRS354 devices, should only be used after SwOS 2.13 release
fixcrs3xx - fixed interface LEDs for QSFP+ and SFP+ interfaces on CRS317, CRS309, CRS312, CRS326-24S+2Q+ and CRS354 devices
othercrs3xx - improved 1Gbps Ethernet port group traffic forwarding for CRS354 devices
othercrs3xx - improved system stability when receiving large frames on CPU for CRS317, CRS309, CRS312, CRS326-24S+2Q+ and CRS354 devices
fixdefconf - fixed default configuration loading on LHG R
fixdefconf - fixed default configuration loading on RBOmniTikPG-5HacD
fixdhcp - fixed link state checking for DHCP client
fixdude - fixed configuration menu presence on ARM64 devices
otherethernet - improved system stability when receiving large VLAN tagged packets on IPQ4018/IPQ4019 devices
fixipsec - fixed SA address parameter exporting
fixlte - fixed "earfcn" to band translation for "cell-monitor"
fixovpn - fixed route cache entry leak when establishing a new session
otherpoe - do not perform PoE firmware upgrade procedure on RB960 and OmniTik devices without PoE out
otherppp - do not fail "at-chat" command when issued on disabled PPP interface
otherptp - improved management service stability when receiving bogus packets
otherquickset - prefer 5GHz interface for WiFi scan in CPE mode
fixrb4011 - fixed SFP+ port MTU setting after link state change
otherrb4011 - improved SFP+ port stability after boot-up
otherroute - improved stability when connected route is modified
othersfp - improved cable length monitoring as defined per SFF-8472 and SFF-8636
fixsupout - fixed "topic" column presence in "Log" section
otherswitch - improved system stability with 98PX1012 switch chip for CCR2004-1G-12S+2XS device
othersystem - improved resource allocation (improves several service stability e.g. HTTPS, PPPoE, VPN)
othertelnet - do not send options if connecting to non standard port
fixtelnet - fixed server when run on non standard port
fixtile - fixed bridge performance degradation (introduced in v6.47)
featurewebfig - allow to specify "prefix" parameter under "IPv6/ND/Prefixes" menu
fixwinbox - fixed "reachable-time" value unit under "IPv6/ND" menu
fixwinbox - fixed QCA-8511 switch chip type reporting under "Switch/Settings" menu
fixwinbox - fixed health reporting on RB960, hEX and hEX S devices
featurewinbox - hide "Allow Roaming" parameter on LTE modems that do not support it
fixwireless - fixed issue with multicast traffic delivery to client devices using power-save
featurewww - added "X-Frame-Options" header information to disallow website embedding in other pages
+12 more items in the release notesfixbgp - fixed VPNV4 RD byte order
fixbranding - fixed LCD logo loading from new style branding package
fixcrs312 - fixed missing SwOS firmware on revision 2 devices
othercrs3xx - correctly filter packets by L2MTU size
fixcrs3xx - improved system stability when receiving large frames for CRS317, CRS309, CRS312, CRS326-24S+2Q+ and CRS354 devices (introduced in v6.47.5)
fixdefconf - fixed default configuration loading on RBcAP-2nD and RBwAP-2nD
fixhotspot - fixed "idle-timeout" usage with RADIUS authentication
securityhotspot - fixed special character parsing in "target" variable (CVE-2021-3014)
otherpackage - do not include multiple The Dude packages in HDD installer
fixsnmp - fixed "send-trap" functionality
fixwebfig - fixed new interface addition
fixwinbox - fixed enable/disable button presence for "Bridge/Hosts" menu
otherwinbox - renamed IP protocol 41 to "ipv6-encap"
otherwinbox - show "System/Health" only on boards that have health monitoring
otherwinbox - use health values reported by gauges for "System/Health" menu
otherwireless - renamed "macedonia" regulatory domain information to "north macedonia"
otherwireless - updated "indonesia5" regulatory domain information
fixcap - fixed L2MTU path discovery
fixchr - fixed file system quiescing
fixcrs3xx - fixed IGMP snooping for CRS312, CRS326-24S+2Q+ and CRS354 devices
fixcrs3xx - fixed switch rules for CRS309 and CRS317 devices (introduced in v6.46.7)
othercrs3xx - improved system stability on CRS354 devices
fixdefconf - fixed default configuration loading on RBmAP-2nD
otherdefconf - improved default configuration generation on devices with changed wireless interface names
otherdhcpv6-server - improved stability when changing server for static bindings
otherdhcpv6-server - properly save bindings when executing "make-static" command
fixfetch - fixed "src-address" usage for SFTP
otherfetch - improved SSL handshake processing
otherhotspot - do not verify Hotspot interface status when detecting if HTTP/HTTPS login method is allowed
fixleds - fixed LED type setting
fixlte - fixed multiple APN passthrough on R11e-4G
otherlte - limit allowed APN count to 3 on R11e-LTE
fixmpls - fixed duplicate "LabelRelease" message sending
otherospf - optimized LSA printing for smaller message sizes
fixpoe - fixed automatic PoE firmware upgrade procedure
otherpoe - improved PoE-out status detection
featureppp - allow specifying pool name for "remote-ipv6-prefix-pool" parameter
featureradius - added "Service-Type" attribute to Access-Request for IPv4 and IPv6 DHCP servers
othersmips - reduced RouterOS main package size
fixsms - fixed SMS sending when both "interface" and "smsc" parameters are specified
fixsnmp - fixed "/tool snmp-get" functionality (introduced in v 6.46beta43)
fixswitch - fixed Ethernet padding for small packets
otheruser - improved WinBox and The Dude authenticated session handling
otheruser-manager - updated PayPal's root certificate authorities
othervrrp - made "password" parameter sensitive
otherw60g - general stability and performance improvements
featurewireless - added support for US FCC UNII-2 and Canada country profiles for NetMetal series devices
fixwireless - fixed incorrect wireless capability information in association response frames
otherwireless - updated "kazakhstan" regulatory domain information
fixbridge - fixed host table update on SNMP query
fixbridge - fixed STP alternate and backup port states for devices with switch chip
fixcrs3xx - fixed hardware offloaded MPLS forwarding when using bonding interfaces
fixcrs3xx - fixed QSFP+ interface LEDs when using break-out cable for CRS326-24S+2Q+
fixcrs3xx - fixed switch ACL rules for CRS312, CRS326-24S+2Q+ and CRS354 devices
fixcrs3xx - fixed switch port "egress-rate" removal for CRS305, CRS326-24G-2S+, CRS328, CRS318 devices
fixdefconf - fixed default configuration loading on RBmAPL-2nD
fixdot1x - fixed duplicate EAP request packets for server
fixdot1x - fixed EAP packet version numbering
featureemail - added support for multiple "to" recipients
fixexport - fixed HotSpot "address-per-mac" parameter export
fixftp - fixed possible buffer overflow
fixike2 - fixed local side NAT detection
fixike2 - fixed policy reference for pending acquire
featureinterface - added new builtin "static" interface list
fixkidcontrol - fixed "time-unlimited-rate" to engage in correct time
fixlte - fixed modem initialization when multiple modems are used simultaneously
fixlte - fixed PDP authentication configuration for SIM7600
fixmetarouter - fixed image importing (introduced in v6.46)
fixospf - fixed disappearing NSSA default route
fixospf - fixed processing of "unknown" LSA type
fixpoe - fixed "power-cycle" functionality on hEX PoE, PowerBox Pro and OmniTIK 5 PoE ac
featureprofile - added support for CCR2004-1G-12S+2XS
fixqsfp - fixed auto-negotiation status
fixquickset - fixed invalid configuration applying when performing changes during LTE modem initialization process
fixrouterboard - fixed "reset-button" menu presence on all devices
fixrouterboot - fixed etherboot FCS errors with 100Mbps rate for CRS305, CRS309 and CRS317 devices ("/system routerboard upgrade" required)
fixsmb - fixed file path validation (introduced in v6.46)
securitysmb - fixed possible memory leak (CVE-2020-11881)
featuresniffer - allow setting port for "streaming-server"
featuresnmp - added "dot1qTpFdbTable" OID reporting for Q-BRIDGE-MIB
featurew60g - added "mdmg-fix" parameter for RBwAP60Gx3 (CLI only)
featurewinbox - added "region" parameter for W60G interfaces
featurewinbox - allow to specify any Ethernet like interface under "Tool/WoL" menu
featurewinbox - do not allow to enter empty strings in "caps-man-names" and "common-name" parameters
featurewireless - added support for U-NII-2 for cAP ac
featurewireless - added support for U-NII-2 for wAP ac
featurewireless - allow setting "tx-power" up to 40
securitywireless - fixed potential wireless driver issue related to CVE-2020-3702
featurewww - added "tls-version" parameter in "IP->Services" menu
+37 more items in the release notesotherarm - improved watchdog and kernel panic reporting in log after reboots on RB3011 and IPQ4018/IPQ4019 devices ("/system routerboard upgrade" required)
fixcapsman - fixed "certificate" parameter updating on CAP
fixcertificate - fixed certificate verification when flushing CRL's
featurechr - added support for file system quiescing
featurechr - enabled support for VMBus protocol version 4.1
otherchr - improved system stability when running CHR on Hyper-V
otherconsole - prevent incorrect type interfaces appearing in command hints
fixcrs3xx - fixed frame forwarding after disabling/enabling bridge hardware offloading for CRS354-48G-4S+2Q+ device
fixcrs3xx - fixed interface statistics for CRS354-48G-4S+2Q+ and CRS354-48P-4S+2Q+ devices
fixcrs3xx - fixed switch rule "dst-port" parameter for IPv6 traffic on CRS305-1G-4S+, CRS326-24G-2S+, CRS328-24P-4S+, CRS328-4C-20S-4S+, netPower 15FR devices
featuredefconf - added welcome note with common first steps for new users
fixhealth - fixed maximum SFP temperature reading under '/system health' menu
fixhotspot - fixed redirect to log in page (introduced in v6.45)
featureled - added "dark-mode" functionality for CRS105-5S-FB
featurelte - added "phy-cellid" value support for LTE-US
fixlte - fixed IP type selection from APN on RBSXTLTE3-7
fixsniffer - fixed minor typo in "host" menu
fixsnmp - fixed "ifSpeed" reporting for tunnel interfaces
fixsnmp - fixed "routeros-version" value returning from registration table
fixsnmp - fixed UPS battery voltage value scaling
featuressh - added support for RSA keys with SHA256 hash (RFC8332)
fixsystem - improved system stability when forwarding traffic from switch chip to CPU (introduced in v6.43)
featurewebfig - added default configuration confirmation window to WebFig
featurewebfig - allow skin designing without "ftp" and "sensitive" policies
featurewinbox - added "Options" parameter support for DHCPv6 client and server
featurewinbox - added 160Mhz extension channel support for CAPsMAN
featurewinbox - added support for "Tools->WoL" menu
fixwinbox - fixed "ARP" parameter inheritance from "CAPs Configuration" configuration
fixwinbox - fixed "Bands" parameter display for LTE interfaces
fixwinbox - fixed "DSCP" parameter value setting
fixwinbox - fixed "Frequency" and "Secondary Frequency" parameter inheritance from "CAPs Channel" configuration
fixwinbox - fixed "Passthr. MAC Address" parameter display "LTE APNs" menu
fixwinbox - fixed "Switch" menu on CRS354-48P-4S+2Q+
fixwinbox - fixed "dst-port" unsetting in "IP->Hotspot->Walled Garden" menu
fixwinbox - fixed "invalid" flag presence under "System/Certificates/CRL" menu
fixwinbox - fixed automatic "IPv6->Firewall->Address List" table update
securitywinbox - made "none" the default value for "Security Profile" parameter when creating a new "Wirelees->Connect list" entry
featurewireless - added "skip-dfs-channels" parameter
featurewireless - allow using FCC "U-NII-2" frequency range for hAP ac2 and RBwAPGR series devices
fixwireless - fixed default "antenna-gain" setting on SXT 2 devices
+20 more items in the release notesfixcapsman - fixed background scan showing incorrect regulatory domain mismatch error (CAP upgrade required)
othercapsman - improved radar detection algorithm
otherchr - improved stability when changing ARP modes on e1000 type adapters
fixconsole - fixed "clear-history" restoring historic actions after power cycle
otherconsole - removed "edit" and "set" actions from "System/History" menu
otherconsole - updated copyright notice
othercrs305 - disable optical SFP/SFP+ module Tx power after disabling SFP+ interface
otherdhcpv4-server - improved stability when RADIUS interim update is sent
fixdhcpv6-client - fixed timeout when doing rebind
otherdhcpv6-client - properly update bind time when unused prefix received from the server
otherdhcpv6-client - properly update IPv6 address on rebind
fixdhcpv6-server - fixed logged error message when using "address-pool=static-only"
otherdhcpv6-server - ignore prefix-hint from client's DHCPDISCOVER if static prefix received from RADIUS
fixhealth - fixed health reporting on OmniTIK 5 PoE ac
otheripsec - improved system stability when processing decrypted packet on unregistered interface
otherl2tp - improved system stability when disconnecting many clients at once
fixled - fixed default LED configuration for RBLHG-2nD and RBLHG-5HPnD
otherlte - show SIM error when no card is present
fixppp - fixed connection establishment when receiving "0.0.0.0" DNS
fixppp - fixed minor typo in "ppp-client" monitor
otherppp - prioritize "remote-ipv6-prefix-pool" from PPP secret over PPP profile
otherqsfp - do not report bogus monitoring readouts on modules without DDMI support
otherqsfp - improved module monitoring readouts for DAC and break-out cables
featurerouterboard - added "mode-button" support for RBcAP2nD
securitysecurity - fixed vulnerability for routers with default password (limited to Wireless Wire), admin could login on startup with empty password before default configuration script was fully loaded
fixssh - fixed output printing when "command" parameter used
othertimezone - updated time zone database to version 2019c
othertraffic-generator - improved memory handling on CHR
fixw60g - fixed "monitor" command on disabled interfaces
featurewinbox - automatically refresh "Packets" table when new packets are captured by "Tools/Packet Sniffer"
otherwinbox - show "LCD" menu only on boards that have LCD screen
featurewireless - added "ETSI" regulatory domain information
featurewireless - added "indonesia4" regulatory domain information
featurewireless - added U-NII-2 support forRBSXTsqG-5acD, RBLHGG-5acD-XL, RBLHGG-5acD, RBLDFG-5acD, RBDiscG-5acD
featurewireless - allow using "canada2" regulatory domain on US lock devices
fixwireless - fixed sensor MAC address reporting in TZSP header
otherwireless - improved compatibility by adding default installation mode and antenna gain for devices with integrated antennas
otherwireless - improved compatibility for Switzerland wireless country profile to improve compliance with ETSI regulations
otherwireless - improved IPQ4019, QCA9984, QCA9888 wireless interface stability
securityFixes CVE-2020-20221: Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticated remote attacker can cause a Denial o…
securityMAJOR CHANGES IN v6.44.6: ---------------------- !) package - accept only packages with original filenames (CVE-2019-3976); !) package - improved package signature verification (CVE-2019-3977); !) security - fixed improper handling of DNS responses (CVE-2019-3978, CVE-2019-3979);…
fixcapsman - fixed frequency setting requiring multiple frequencies
fixcapsman - fixed newline character missing on some logging messages
otherccr - improved packet processing after overloading interface
fixcrs312 - fixed combo SFP port toggling (introduced in v6.44.5)
othercrs328 - adjust fan speed based on SFP and CPU temperature
othercrs3xx - correctly display link rate when 10/100/1000BASE-T SFP modules are used in SFP+ interfaces
fixcrs3xx - fixed management access when using switch rule "new-vlan-priority" property
fixexport - fixed "bootp-support" parameter export
otherhealth - improved fan control on CRS3xx and CCR1016-12S-1S+r2
fixike2 - fixed policy port selection for responder with natted initiator
fixike2 - fixed traffic selector address family selection when using IPv6
fixinterface - fixed missing PWR-LINE section on PL7411-2nD and PL6411-2nD (introduced v6.44)
featureipsec - allow inline "passphrase" parameter when importing keys
fixipsec - fixed minor spelling mistakes in logs
fixled - fixed default LED configuration for RBLHG5nD
fixospf - fixed opaque LSA type checking in OSPFv2
fixospf - fixed possible busy loop condition when accessing OSPF LSAs
otherospf - improved "unknown" LSA handling in OSPFv3
featureprofile - added "internet-detect" process classificator
fixradius - fixed open socket leak when invalid packet is received (introduced in v6.44)
fixsfp - fixed "sfp-rx-power" value for some transceivers
othersmb - improved stability on x86 and CHR
fixsnmp - fixed encrypted data sequence (introduced in v6.44.5)
othersnmp - improved reliability on SNMP service packet validation
otherssh - accept remote forwarding requests with empty hostnames
fixssh - fixed carriage return presence in subsequent sessions
fixssh - improved remote forwarding handling (introduced in v6.44.3)
fixsupout - fixed supout file generation outside of internal storage with insufficient space
fixswitch - fix port isolation for non-CRS series switch chips
securitysystem - accept only valid string for "name" parameter in "disk" menu (CVE-2019-15055)
othersystem - improved system stability for devices with AR9342 SoC
fixupgrade - fixed "auto-upgrade" to use new style authentication
fixupnp - fixed XML parsing (FG-VD-19-110)
otherwatchdog - renamed "no-ping-delay" parameter to "ping-start-after-boot"
featurewinbox - added "auto-erase" parameter to "Tools/SMS" menu
featurewinbox - added "https-redirect" parameter to "IP/Hotspot/Profiles menu"
featurewinbox - added "revision" parameter to "System/Routerboard" menu
otherwinbox - removed "max-sms" parameter from "Tools/SMS" menu
+4 more items in the release notessecurityMAJOR CHANGES IN v6.44.5: ---------------------- !) security - fixed vulnerabilities CVE-2019-13954, CVE-2019-13955; !) security - fixed vulnerabilities CVE-2019-11477, CVE-2019-11478, CVE-2019-11479; !) security - fixed vulnerability CVE-2019-13074; ----------------------
otherbridge - correctly handle bridge host table
fixcapsman - fixed CAP system upgrading process for MMIPS
fixcapsman - fixed interface-list usage in access list
othercertificate - removed "set-ca-passphrase" parameter
othercloud - properly stop "time-zone-autodetect" after disable
securityconntrack - fixed GRE protocol packet connection-state matching (CVE-2014-8160)
otherdefconf - automatically set "installation" parameter for outdoor devices
fixdhcpv6-client - fixed status update when leaving "bound" state
fixdhcpv6-server - fixed dynamic IPv6 binding without proper reference to the server
otherdhcpv6-server - override prefix pool and/or DNS server settings by values received from RADIUS
fixdiscovery - fixed CDP packets not including address on slave ports (introduced in v6.44)
othere-mail - properly release e-mail sending session if the server's domain name can not be resolved
fixfirewall - fixed fragmented packet processing when only RAW firewall is configured
otherfirewall - process packets by firewall when accepted by RAW with disabled connection tracking
othergps - strip unnecessary trailing characters from "longtitude" and "latitude" values
otherhotspot - moved "title" HTML tag after "meta" tags
otheripv6 - improved system stability when receiving bogus packets
securityovpn - added "verify-server-certificate" parameter for OVPN client (CVE-2018-10066)
otherrb3011 - improved system stability when receiving bogus packets
otherrb921 - improved system stability ("/system routerboard upgrade" required)
othersnmp - improved reliability on SNMP service packet validation
fixssh - fixed non-interactive multiple command execution
featuresupout - added IPv6 ND section to supout file
featuresupout - added "pwr-line" section to supout file
othersupout - changed IPv6 pool section to output detailed print
featurewinbox - do not allow setting "dns-lookup-interval" to "0"
otherwireless - improved DFS radar detection when using non-ETSI regulated country
otherwireless - improved installation mode selection for wireless outdoor equipment
otherwireless - updated "china" regulatory domain information
securitywww - improved client-initiated renegotiation within the SSL and TLS protocols (CVE-2011-1473)
fixw60g - fixed memory leak (introduced in v6.43.15)
fixdhcpv4-server - fixed commenting option for alerts
fixdhcpv6-server - fixed binding setting update from RADIUS
otherike1 - improved stability for transport mode policies on initiator side
otheripv6 - adjusted IPv6 route cache max size
otheripv6 - adjust IPv6 route cache max size based on total RAM memory
otheripv6 - improved IPv6 neighbor table updating process
otherlte - reset LTE modem only when SIM slot is changed on dual SIM slot devices
otherlte - use default APN name "internet" when not provided
otherrb2011 - removed "sfp-led" from "System/LEDs" menu
fixrb4011 - fixed SFP+ interface full duplex and speed parameter behaviour
otherrb4011 - improved SFP+ interface linking to 1Gbps
fixsmb - fixed possible buffer overflow
featuresnmp - added "radio-name" (mtxrWlRtabRadioName) OID support
otherssh - do not generate host key on configuration export
fixswitch - fixed possible crash when interface state changes and DHCP Snooping is enabled
othersystem - accept only valid path for "log-file" parameter in "port" menu
otheruserman - updated authorize.net gateway DNS name
otherwebfig - improved file handling
otherwinbox - improved file handling
otherwinbox - show "R" flag under "IPv6/DHCP Server/Bindings" tab
featurewireless - added support for US FCC UNII-2 and Canada country profiles for LHG-5HPnD-US, RBLHG-5HPnD-XL-US and SXTsq5HPnD-US devices
otherwireless - improved wireless country settings for EU countries, outdoor models will use outdoor frequency range by default
otherwireless - improved system stability for all devices with 802.11ac wireless
otherwireless - improved wireless country settings for EU countries
otheripv6 - adjust IPv6 route cache max size based on total RAM memory
otherbridge - count routed FastPath packets between bridge ports under FastPath bridge statistics
fixbridge - fixed BOOTP packet forwarding when DHCP Snooping is enabled
fixbridge - fixed packet forwarding with enabled DHCP Snooping and Option 82
fixbridge - fixed possible memory leak when using "ingress-filtering=yes" on bridge interface
fixbridge - fixed system's identity change when DHCP Snooping is enabled (introduced in v6.43)
othercapsman - always accept connections from loopback address
othercertificate - force 3DES encryption for P12 certificate export
fixdhcp - fixed dual stack queue addition
featuredhcpv6-server - allow to add DHCPv6 server with pool that does not exist
fixdhcpv6-server - fixed missing gateway for binding's network if RADIUS authentication was used
featureethernet - added "tx-rx-1024-max" counter to Ethernet stats
fixethernet - fixed packet forwarding when SFP interface is disabled on hEX S
otherfetch - improved file downloading to slow memory
othergps - increase precision for dd format
othergps - removed unnecessary leading "0" for dd format
fixipsec - fixed all policies not getting installed after startup (introduced in v6.43.8)
fixipsec - fixed stability issues after changing peer configuration (introduced in v6.43)
featureipv6 - do not allow setting "preferred-lifetime" longer than "valid-lifetime"
featurekidcontrol - added "tur-fri", "tur-mon", "tur-sat", "tur-sun", "tur-thu", "tur-tue", "tur-wed" parameters
fixkidcontrol - fixed validation checks for time intervals
fixled - fixed default LED configuration for RBSXTsq-60ad
fixlldp - fixed missing capabilities fields on some devices
otherlte - do not show "session-uptime" if session is not up
otherlte - improved SIM7600 initialization after reset
fixntp-client - fixed "dst-active" and "gmt-offset" being updated after synchronization with server
fixppp - fixed dynamic route creation towards VPN server when "add-default-route" is used
fixrb4011 - fixed ether10 failing to auto negotiate link speed to 1Gbps
featuresmb - added commenting option for SMB users (CLI only)
fixsmb - fixed macOS clients not showing share contents
fixsmb - fixed Windows 10 clients not able to establish connection to share
fixsupout - fixed "poe-out" output not showing all interfaces
fixsupout - fixed Profile output on single core devices
featurewinbox - added "conflict-detection" parameter in "IP/DHCP Server" menu
featurewinbox - added "coordinate-format" parameter in LTE interface settings
featurewinbox - added "use-local-address" parameter in "IP/Cloud" menu
featurewinbox - allow specifying interface lists in "CAPsMAN/Access List" menu
fixwinbox - fixed "IPv6/Firewall" "Connection limit" parameter not allowing complete IPv6 prefix lengths
fixwinbox - fixed "LCD" menu not shown on RB2011UiAS-2HnD
fixwireless - fixed antenna gain setting on RBSXT5nDr2
featurewireless - improved connection stability for new model Apple devices
+6 more items in the release notessecurityFixes CVE-2019-3924: MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients…
otheripsec - accept only valid path for "export-pub-key" parameter in "key" menu
fixquickset - fixed "country" parameter not properly setting regulatory domain configuration
fixsmb - fixed possible buffer overflow
fixw60g - fixed disconnection issues in PtMP setups
otherwireless - improved antenna gain setting for devices with built in antennas
otherwireless - show indoor/outdoor frequency limitations under "/interface wireless info country-info" command
fixcapsman - fixed "group-key-update" parameter not using correct units
othercertificate - properly flush old CRLs when changing store location
otherconsole - properly remove system note after configuration reset
otherdhcpv6-server - properly handle DHCP requests that include prefix hint
fixdiscovery - fixed malformed neighbor information for routers that has incomplete IPv6 configuration
fixdiscovery - fixed neighbor discovery for PPP interfaces
fixexport - fixed "silent-boot" compact export
featuregps - added "coordinate-format" parameter
otherinterface - improved system stability when including/excluding a list to itself
featurekidcontrol - do not allow users with "read" policy to pause and resume kids
fixled - fixed default LED configuration for RBMetalG-52SHPacn
otherlog - properly handle long echo messages
featurelte - added support for more ZTE MF90 modems
otherlte - disallow setting LTE interface as passthrough target
otherpackage - use bundled package by default if standalone packages are installed as well
fixresource - fixed "total-memory" reporting on ARM devices
featuresnmp - added "tx-ccq" ("mtxrWlStatTxCCQ") and "rx-ccq" ("mtxrWlStatRxCCQ") values
othersnmp - do not initialise interface traps on bootup if they are not enabled
fixswitch - fixed MAC learning when disabling interfaces on devices with Atheros8327 and QCA8337 switch chips
fixsystem - fixed situation when all configuration was not properly loaded on bootup
fixtimezone - fixed "Europe/Dublin" time zone
otherupgrade - automatically uninstall standalone package if already installed in bundle
otherwebfig - do not show bogus VHT field in wireless interface advanced mode
featurewinbox - allow to change VHT rates when 5ghz-n/ac band is used
otherwinbox - renamed "Radius" to "RADIUS"
otherwinbox - show "Switch" menu on RB4011iGS+5HacQ2HnD and RB4011iGS+
featurewireless - added new "installation" parameter to specify router's location
otherwireless - improved stability for 802.11ac
otherwireless - improvements in wireless frequency selection
otherbridge - do not learn untagged frames when filtering only tagged packets
fixbridge - fixed possible memory leak when VLAN filtering is used
otherbridge - improved packet handling when hardware offloading is being disabled
otherbridge - properly disable dynamic CAP interfaces
fixcertificate - fixed time zone adjustment for SCEP requests
othercrs328 - improved link status update on disabled SFP and SFP+ interfaces
othercrs328 - improved link status update on disabled SFP+ interface when using DAC
fixcrs3xx - fixed possible memory leak when disabling bridge interface
otherdefconf - automatically accept default configuration if reset done by holding button
fixdefconf - properly load default configuration after reset (introduced in v6.42.9)
fixhealth - fixed bad voltage readings on RB493G
fixipsec - fixed hw-aead (H) flag presence under Installed SAs on startup
otheripsec - improved stability when uninstalling multiple SAs at once
otheripsec - properly update warnings under peer menu
featureled - added "dark-mode" functionality for LHG and LDF series devices
fixled - fixed default LED configuration for SXT LTE kit and wAP 60G AP devices
fixled - fixed power LED turning on after reboot when "dark-mode" is used
fixntp - fixed possible NTP server stuck in "started" state
otherospf - improved stability while handling type-5 LSAs
otherromon - improved packet processing when MTU in path is lower than 1500
otherrouterboard - renamed SIM slots to "a" and "b" on SXT LTE kit
otherrouterboard - show "boot-os" and "force-backup-booter" options only on devices that have such feature
othertimezone - updated timezone information from tzdata2018g release
fixtraffic-flow - fixed post NAT port reporting
fixtraffic-flow - fixed "src-mac-address" and added "post-src-mac-address" fields
othertunnel - made "ipsec-secret" parameter sensitive
fixusb - fixed power-reset for hAP ac^2 devices
fixw60g - fixed misleading license level requirement log message
fixw60g - fixed "scan" functionality when in bridge mode
otherw60g - renamed "frequency-list" to "scan-list"
featurewinbox - allow to specify SIM slot on LtAP mini
featurewinbox - enabled "fast-forward" by default when adding new bridge
otherwinbox - show "System/Health" only on boards that have health monitoring
otherwinbox - show "W60G" wireless tab on wAP 60G AP
otherbridge - ignore tagged BPDUs when bridge VLAN filtering is used
otherbridge - improved packet handling when hardware offloading is being disabled
fixcrs317 - fixed packet forwarding on bonded interfaces without hardware offloading
fixcrs326/crs328 - fixed packet forwarding when port changes states with IGMP Snooping enabled
otherdefconf - properly clear global variables when generating default configuration after RouterOS upgrade
fixdns - fixed DNS cache service becoming unresponsive when active Hotspot server is present on the router (introduced in 6.42)
fixfilesystem - fixed NAND memory going into read-only mode (requires "factory-firmware" >= 3.41.1 and "current-firmware" >= 6.43)
featurehealth - added missing parameters from export
fixhealth - fixed voltage measurements for RB493G devices
otherhotspot - properly update dynamic "walled-garden" entries when changing "dst-host"
fixike2 - fixed rare authentication and encryption key mismatches after rekey with PFS enabled
otherike2 - improved subsequent phase 2 initialization when no child exist
otheripsec - improved invalid policy handling when a valid policy is uninstalled
otheripsec - improved stability when using IPsec with disabled route cache
featureled - added "dark-mode" functionality for wsAP ac lite, RB951Ui-2nD, hAP, hAP ac lite and LtAP mini devices
fixlte - fixed LTE interface not working properly after reboot on RBSXTLTE3-7
fixlte - fixed LTE registration in 2G/3G mode
otherospf - improved link-local LSA flooding
otherospf - improved stability when originating LSAs with OSPFv3
fixrouterboard - fixed memory tester reporting false errors on IPQ4018 devices ("/system routerboard upgrade" required)
otherrouterboard - show "boot-os" option only on devices that have such feature
fixrouterboot - fixed RouterOS booting on devices with particular NAND memory
othersniffer - made "connection", "host", "packet" and "protocol" sections read-only
featuresupout - added "files" section to supout file
fixupgrade - fixed RouterOS upgrade process from RouterOS v5 on PowerPC
otherupnp - improved UPnP service stability when handling HTTP requests
fixuserman - fixed "shared-secret" parameter requiring "sensitive" policy
featurew60g - added "frequency-list" setting
fixw60g - fixed interface LED status update on connection
fixw60g - fixed random disconnects
otherw60g - general stability and performance improvements
fixwebfig - fixed time interval settings not applied properly under "IP/Kid Control/Kids" menu
fixwebfig - fixed www service becoming unresponsive
otherwinbox - show "System/RouterBOARD/Mode Button" on devices that has such feature
otherwireless - accept only valid path for sniffer output file parameter
fixwireless - fixed "/interface wireless sniffer packet print follow" output
fixled - fixed unused "link-act-led" LED trigger on RBLHG 2nD, RBLHG 2nD-XL and RBSXTsq 2nD
otherled - removed unused "link-act-led" trigger for devices which does not use it
othernetinstall - sign Netinstall executable with an Extended Validation Code Signing Certificate
otherpoe - do not show "poe-out-current" on devices which can not determine it
otherpoe - hide PoE related properties on interfaces which does not provide power output
otherwinbox - made UDP local and remote TX size parameters optional in Bandwidth Test tool
otherwinbox - show dual SIM options only for RouterBOARDs which does have two SIM slots
otherwinbox - use proper graph name for HDD graphs
otherwireless - enable all chains by default on devices without external antennas after configuration reset
securityMAJOR CHANGES IN v6.40.9: ---------------------- !) security - fixed vulnerabilities CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159; ----------------------
fixcertificate - fixed "add-scep" template existence check when signing certificate
fixdefconf - fixed wAP LTE kit default configuration
otherethernet - improved large packet handling on ARM devices with wireless
otherethernet - removed obsolete slave flag from "/interface vlan" menu
fixfilesystem - fixed NAND memory going into read-only mode
fixhotspot - fixed user authentication when queue from old session is not removed yet
fixinterface - fixed interface configuration responsiveness
fixipsec - fixed policies becoming invalid if added after a disabled policy
otherldp - properly load LDP configuration
fixppp - fixed "hunged up" grammar to "hung up" within PPP log messages
othersfp - hide "sfp-wavelength" parameter for RJ45 transceivers
featuresnmp - added remote CAP count OID for CAPsMAN
featuresupout - added "partitions" section to supout file
fixtile - fixed Ethernet interfaces becoming unresponsive
fixtr069-client - fixed unresponsive tr069 service when blackhole route is present
fixuserman - fixed compatibility with PayPal TLS 1.2
otheruserman - improved unique username generation process when adding batch of users
featurewinbox - added missing "dscp" and "clamp-tcp-mss" settings to IPv6 tunnels
featurewinbox - allow to specify full URL in SCEP certificate signing process
otherwinbox - by default specify keepalive timeout value for tunnel type interfaces
otherwinbox - show firmware upgrade message at the bottom of "System/RouterBOARD" menu
otherwinbox - show "scep-url" for certificates
otherwinbox - show "sector-writes" on ARM devices that have such counters
otherwinbox - show "sector-writes" on devices that have such counters
otherwinbox - show "System/Health" only on boards that have health monitoring
featurewireless - added option to disable PMKID for WPA2
otherwireless - enable all chains by default on devices without external antennas after configuration reset
fixwireless - fixed packet processing after removing wireless interface from CAP settings
otherwireless - improved client "channel-width" detection
otherwireless - improved Nv2 PtMP performance
otherwireless - increased stability on hAP ac^2 and cAP ac with legacy data rates
otherwireless - updated "united-states" regulatory domain information
fixcertificate - fixed incorrect SCEP URL after an upgrade
fixhealth - fixed empty measurements on CRS328-24P-4S+RM
otherike2 - use "policy-template-group" parameter when picking proposal as initiator
fixipv6 - fixed IPv6 behaviour when bridge port leaves bridge
fixrouterboard - fixed "mode-button" support on hAP lite r2 devices
fixssh - fixed SSH service becoming unavailable
fixtraffic-flow - fixed IPv6 destination address value when IPFIX protocol is used
otherwinbox - show "Switch" menu on cAP ac devices
otherwireless - improved compatibility with BCM chipset devices
featureconsole - do not allow variables that start with digit to be referenced without "$" sign
fixled - fixed unused "link-act-led" LED trigger on RBLHG 2nD, RBLHG 2nD-XL and RBSXTsq 2nD
othernetinstall - sign Netinstall executable with an Extended Validation Code Signing Certificate
otherromon - make "secret" field sensitive in console
fixtr069-client - fixed TR069 service becoming unavailable when related service package is not installed
fixwinbox - fixed "/tool e-mail send" attachment behavior
fixwinbox - fixed maximal ID for Traffic Generator stream
otherwinbox - made UDP local and remote TX size parameter optional in Bandwidth Test tool
otherwinbox - removed "Enable" and "Disable" buttons from IPsec "mode-config" list
otherwinbox - show "D" flag under "/ip dhcp-client" menu
otherwinbox - use proper graph name for HDD graphs
otherwireless - enable all chains by default on devices without external antennas after configuration reset
fixbtest - fixed TCP test accuracy when low TX/RX rates are used
othercertificate - do not use UTF-8 for SCEP challenge password
fixcertificate - fixed PKCS#10 version
featurechr - generate new system ID on first boot
fixcrs317 - fixed reliability on FAN controller
fixdefconf - fixed DISC Lite5 LED default configuration
fixdhcpv4-server - fixed framed and classless route received from RADIUS server
fixdisk - fixed disk detach process
fixdude - fixed e-mail notifications when default port is not used
fixexport - fixed "/system routerboard mode-button" compact export
featurefilesystem - implemented additional system integrity checks on reboots
otherfirewall - limited maximum "address-list-timeout" value to “35w3d13h13m56s”
fixhotspot - fixed "dst-port" to require valid "protocol" in "walled-garden ip"
fixhotspot - fixed Walled Garden IP functionality when address-list is used
fixike1 - fixed crash on XAUTH if user does not exist
fixike1 - fixed memory corruption when IPv6 is used
otherike1 - improved stability on phase1 rekeying
featureike2 - added support for multiple split networks
otherike2 - delay rekeyed peer outbound SA installation
otherike2 - improve half-open connection handling
otherike2 - kill connection when peer changes address
otherike2 - use peer configuration address when available on empty TSi
fixipsec - fixed incorrect esp proposal key size usage
fixovpn - fixed resource leak on systems with high CPU usage
fixppp - fixed "change-mss" functionality when MSS is not set on forwarded packets
fixppp - fixed L2TP and PPTP encryption negotiation process on configuration changes
fixroute - fixed DHCP/PPP “add-default-route” “distance” minimal value to 1
fixsms - fixed minor problem for SMS delivery
featuresnmp - added IPv6 addresses support on default "public" community
fixsnmp - fixed bulk requests when non-repeaters are used
fixsnmp - fixed consecutive OID bulk get from the same table
fixtraceroute - fixed "/tool traceroute" results print
featurewebfig - added support for proper default policies when adding script or scheduler job
fixwebfig - fixed backup loading from Webfig on RouterBOARD running default configuration
fixwebfig - fixed bridge port sorting order by name
fixwebfig - fixed MAC address ordering
fixwebfig - fixed router getting reset to default configuration
fixwebfig - fixed column ordering
featurewinbox - allow to specify "to-ports" for "action=masquerade"
fixwireless - fixed wireless protocol mode restrictions if lockpack is installed and has limits for it
+17 more items in the release notesfixbonding - fixed 802.3ad mode on RB1100AHx4
fixconsole - fixed different command auto complete
fixcrs1xx/2xx - fixed 1 Gbps forced mode for several SFP modules
featurecrs317 - added L2MTU support
fixdhcp - fixed downgrade from RouterOS v6.41 or higher
fixdhcpv4-server - fixed lease renew for DHCP clients that sends renewal with "ciaddr = 0.0.0.0"
fixdhcpv6-client - fixed IA evaluation order
fixdiscovery - fixed timeouts for LLDP neighbours
fixethernet - fixed occasional broken interface order after reset/first boot
fixethernet - fixed rare linking problem with forced 10Mbps full-duplex mode
fixexport - fixed export for PoE-OUT related settings
fixexport - fixed wireless "ssid" and "supplicant-identity" compact export
fixfasttrack - fixed fasttrack over interfaces with dynamic MAC address
fixfirewall - fixed bridge "action=log" rules
fixfirewall - fixed crash on fasttrack dummy rule manual change attempt
fixike1 - fixed initiator ID comparison to NAT-OA
fixipv6 - fixed IPv6 address request from pool
fixmetarouter - fixed display of bogus error message on startup
featureovpn - added support for "push-continuation"
featureovpn - added support for topology subnet for IP mode
fixovpn - fixed duplicate default gateway presence when receiving extra routes
fixping - fixed ping getting stuck (after several thousands of ping attempts)
fixppp - fixed non-standart PAP or CHAP packet handling
fixpppoe-client - fixed incorrectly formed PADT packet
fixpppoe-client - fixed wrong MRU detection over VLAN interfaces
fixproxy - fixed rare program crash after closing client connection
fixquickset - fixed incorrect VPN address value on arm and tilera
fixrb1100ahx4 - fixed HW acceleration fragmented packet decryption when fragment is smaller than 64 bytes
fixrb1100ahx4 - fixed startup problems (requires additional reboot after upgrade)
fixrb2011 - fixed possible LCD blinking along with ethernet LED
fixrb3011 - fixed packet passthrough on switch2 while booting
fixsafe-mode - fixed session handling when Safe Mode is used on multiple sessions at the same time
fixsfp - fixed invalid temperature readings when ambient temperature is below 0C
fixsfp - fixed OPTON module DDM information readings
featurevlan - do not allow VLAN MTU to be higher than L2MTU
featurewebfig - allow to unset "rate-limit" for DHCP leases
featurewinbox - added possibility to define "comment" for "/routing bgp network" entries
featurewinbox - added support for certificate CRL list
featurewireless - added "etsi1" and "russia3" regulatory domain information
featurewireless - updated "china", "norway" and "new-zealand" regulatory domain information
+47 more items in the release notesfix6to4 - fixed wrong IPv6 "link-local" address generation
fixarp - fixed "make-static"
featurebonding - do not add bonding interface if "could not set MTU" error is received
fixconsole - fixed "/ip neighbor discovery" export
fixconsole - fixed unexpected console crash when using variables as functions
fixdefconf - fixed default configuration generation when wireless package is disabled
fixdefconf - fixed Groove 52 ac band settings
fixethernet - fixed "loop-protect" on "master-port"
fixethernet - fixed rare switch chip hang (could cause port flapping)
fixfetch - fixed download issue over HTTPS
featurefirewall - do not allow to set "rate" value to 0 for "limit" parameter
fixfirewall - fixed "address-list" entry "creation-time" adjustment to timezone
fixfirewall - fixed "address-list" entry changing from IP to DNS and vice versa
fixfirewall - fixed cosmetic "invalid" flag when item was disabled
fixike1 - fixed crash on xauth message
featureike2 - allow multiple child SA traffic selectors on re-key
fixike2 - fixed last EAP authentication payload type
fixike2 - fixed policy release during SA negotiation
fixike2 - fixed RSA authentication without EAP
fixike2 - fixed situation when traffic selector prefix was parsed incorrectly
fixipsec - fixed generated policy priority
fixipsec - fixed peer "my-id" address reset
breakingipv6 - fixed address becoming invalid when interface was removed from bridge/mesh
fixled - fixed turning off LED when interface is lost
featurelog - added missing "license limit exceeded" log entry
fixnetinstall - fixed typos in Netinstall status messages
fixppp - fixed IPv6 address receiving on PPP interface
featurepppoe - added warning on PPPoE client/server, if it is configured on slave interface
featuresnmp - added fan-speed OIDs in "/system health print oid"
featureuserman - allow "name-for-user" to be empty and not unique
featurewebfig - allow to enter frequency ranges in wireless “scan-list”
featurewebfig - allow to select "default-encryption" profile on PPP tunnels
featurewebfig - do not allow to reorder items if table is sorted by some column
featurewinbox - added "Flush" button under “unicast-fdb” menu
featurewinbox - added "memory-scroll", "filter-cpu", "filter-ipv6-address", "filter-operation-between-entries" Sniffer parameters
featurewinbox - added “protected-routerboard” parameters under RouterBOARD settings menu
featurewinbox - allow shorten bytes to k,M,G in firewall "connection-bytes" and "connection-rates"
featurewinbox - do not allow Packet Sniffer "memory-limit" and "file-limit" lower than 10KiB
featurewinbox - do not allow to open multiple same sub-menus at the same time
securitywinbox - hide "wps-mode" & "security-profile" in wireless nv2 mode
+35 more items in the release notessecurityFixes CVE-2017-20149: The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by s…
fixchr - fixed problem when transmit speed was reduced by interface queues
otherdhcp - do not listen on IPv4/IPv6 client to IPv6 MLD packets
otherdude - (changes discussed here: https://wiki.mikrotik.com/wiki/Manual:The_Dude_v6/dude_v6.xx_changelog)
otherexport - do not show "read-only" IRQ entries
featurefilesystem - implemented procedures to verify and restore internal file structure integrity upon upgrading
featurefirewall - do not allow to set "time" parameter to 0s for "limit" option
fixfirewall - fixed import of exported configuration that had updated "limit" setting
fixgraphing - fixed graphing crash when high amount of traffic is processed
fixhotspot - fixed rare kernel crash on multicore systems
fixhotspot - fixed redirect to URL where escape characters are used (requires newly generated HTML files)
otherhotspot - show Host table commentaries also in Active tab and vice versa
otherinterface - do not treat multiple zeros as single zero on name comparison
otherirq - properly detect all IRQ entries
fixl2tp-client - fixed IPSec policy generation after reboot
otherlcd - show fan2 speed only if it is available
fixleds - fixed defaults for RBSXT5HacD2nr2
othermmips - improved general stability
fixrb3011 - fixed noise from buzzer after silent boot
fixswitch - fixed crash when trying to configure second master port on the same chipset (RB3011, RB2011, CCR1009-8G-1S+)
featureuserman - allow access to User Manager users page only through "/user" URL
otheruserman - show warning when no users are selected for CSV file generation
featurewinbox - added "add-relay-info" and "relay-info-remote-id" to DHCP relay
featurewinbox - added H flag to "/ip arp"
featurewinbox - added missing "use-fan2" and "active-fan2" to "/system health"
featurewinbox - allow shorten bytes to k,M,G in bridge firewall just like in “/ip firewall”
otherwinbox - do not hide "power-cycle-after" option
otherwinbox - do not hide 00:00:00:00:00:00 MAC address in unpublished ARPs
fixwinbox - fixed matching "connection-state=untracked" connections
fixwinbox - fixed typo in “/system resources pci” list
otherwinbox - hide advertise tab in Hotspot user profile configuration if "transparent-proxy" is not enabled
otherwinbox - make "power-cycle-after" show correct value
otherwinbox - make "power-cycle-interval" not to depend on "power-cycle-ping-enabled" in PoE settings
otherwinbox - properly show BGP communities in routing filters table filter
fixwireless - fixed scan tool stuck in background
otherwireless - improved compatibility with Intel 2200BG wireless card
otherwireless - update Thailand country frequency settings
fixbonding - fixed "tx-drop" on VLAN over bonding on x86
featurecertificates - added year cap (invalid-after date will not exceed year 2039)
breakingcertificates - fixed crash when crl is removed while it is being fetched
fixcertificates - fixed fail on import from CAPs when both key and name already exist
featurecrs - added comment ability in more switch menus
fixdhcpv6-client - fixed DHCPv6 rebind on startup
fixdhcpv6-server - fixed server removal crash if static binding was present
fixdns - fixed typo in regexp error message
fixfirewall - fixed "time" option by recognizing weekday properly (introduced in v6.37.2)
fixfirewall - fixed dynamic raw rule behaviour
fixfirewall - fixed rule activation if "time" option is used and no other active rules are present
fixhotspot - fixed nat rule port setting in "hs-unauth-to" chain by changing it from "dst-port" to "src-port" on Walled Garden ip "return" rules
fixipsec - fixed kernel failure on tile with sha256 when hardware encryption is not being used
featureipv6 - added warning about having interface MTU less than minimal IPv6 packet fragment (1280)
fixled - fixed dark mode for cAP 2nD (http://wiki.mikrotik.com/wiki/Manual:System/LEDS#Leds_Setting)
fixlicense - fixed demo license expiration after installation on x86
fixmetarouter - fixed startup process (introduced in 6.37.2)
fixppp - fixed packet size calculation when MRRU is set (was 2 bytes bigger than MTU allows)
featureprofile - added "bfd" and "remote-access" processes
featureprofile - added ability to monitor cpu usage per core
fixproxy - fixed "max-cache-object-size" export
fixqueue - fixed "time" option by recognizing weekday properly (introduced in v6.37.2)
fixrb750Gr3 - fixed ipsec with 3des+md5 to work on this board
fixrb751u - fixed ethernet LEDs
fixsnmp - fixed rare crash when incorrectly formatted packet was received
fixssh - fixed high memory consumption when transferring file over ssh tunnel
fixswitch - fix BPDU dynamic Host table entry on Atheros Gigabit switch chips
fixtraceroute - fixed memory leak
fixtrafficgen - fixed compact export when "header-stack" includes tcp
featurevlan - allow to add multiple VLANs which name starts with same number and has same length
securitywebfig - added extra protection against XSS exploits
featurewinbox - added "Complete" flag to arp table
featurewinbox - added "make-static" to IPv6 DHCP server bindings
featurewinbox - added "prefix-pool" to DHCPv6 server binding
featurewinbox - added upstream flag to IGMP proxy interfaces
featurewinbox - allow to enable/disable traffic flow targets
featurewinbox - allow to specify "connection-bytes" & "connection-rate" for any protocol in “/ip firewall” rules
featurewinbox - allow to specify "sip-timeout" under ip firewall service-ports
featurewinbox - do not allow to set "loop-protect-send-interval" to 0s
securitywireless - show comment on "security-profile" if it is set
+34 more items in the release notesfixarp - fixed crash that caused Ethernet frames to go out via wrong interface
fixfastpath - fixed kernel crash on interface disable/remove
fixfetch - fixed bug with incomplete files in https mode
otheripsec - don't log authtype mismatch as critical
fixipsec - fixed xauth parameter printing in terminal
fixpppoe - fixed kernel crash caused by dial-on-demand when used with fastpath
fixpppoe - fixed master interface l2mtu check, could result in assumption that master interface can handle 14 byte bigger packet than it actually can (broken in 6.36)
fixsimple queues - fixed issue which caused additional/unnecessary CPU load
featurevlan - do not allow to add new vlan interface with mtu higher than l2mtu
fixtile - fixed rare kernel crash when usb device is being attached
otheraddress-list - make "dynamic=yes" as read-only option
fixbonding - fixed 802.3ad load balancing mode over tunnels
fixbonding - fixed bonding primary slave assignment for ovpn interfaces after startup
fixbonding - fixed crash on RoMON traffic transmit
fixdhcpv6 client - fixed ia lifetime validation when it is set by dhcpv6 client
featuredisk - added support for Plextor PX-G128M6e(A) SSD on CCR1072
fixethernet - fixed memory leak when setting interface without changing configuration
otherfirewall - do not show disabled=no in export
fixhealth - fixed broken factory voltage calibration data for some hAP ac boards
fixhealth - fixed incorrect voltage after reboot on RB2011UAS
fixipsec - fixed mode-config export
fixipsec - fixed route cache overflow when using ipsec with route cache disabled
otherlte - use only creg result codes as network status indications
otherovpn - enable perfect forwarding secrecy support by default
fixrb3011 - fixed port flapping on ether6-ether10
fixrb3011 - fixed reset button functionality
otherrb3011 - improved performance on high cpu usage
fixdiscovery - fixed identity discovery (introduced in 6.34.5)
fixlog - fixed time zone adjustment (introduced in 6.34.5)
fixsnmp - fixed snmp timeout (introduced in 6.34.5)
fixvrrp - fixed missing vrrp interfaces after upgrade (introduced in 6.34.5).
otherdude - (http://wiki.mikrotik.com/wiki/Manual:The_Dude_v6/dude_v6.xx_changelog)
otherdude - in order to connect to dude server user requires dude policy to be enabled
otherbonding - do not corrupt bonding statistics on configuration changes
fixbonding - fixed crash when vlan parent mtu is higher than bonding mtu
othercloud - do not write minor status changes to storage
featureethernet - do not allow mtu to be higher than l2mtu and l2mtu to be higher than max-l2mtu (reduce automatically on upgrade if it was wrong before)
otheripsec - better flush on proposal change
fixipsec - fixed crash on policy update
fixlog - fixed reboot log messages
featurelte - do not allow to set multiple modes when it is not supported
fixqueue - fixed interface queue type for ovpn tunnels
fixrb3011 - fixed port flapping on ether6-ether10
fixrb3011 - fixed time keeping
fixswitch - fixed compact export
fixtile - fixed performance regression on switch chip (introduced in 6.33rc18)
otherwinbox - show voltage in Health only if there actually is voltage monitor
fixwireless - fixed issue when CAPsMAN could lock CAPs interface
otherwinbox - show properly route-distinguisher for bgp vpn4
otherwinbox - show dhcp server name in dhcp leases
otherppp - make CoA work correctly with address-lists
fixwinbox - fixed tab names to correspond to console
otherwinbox - show only actual switch-cpu ports in switch setting combobox
fixwinbox/webfig - fixed version column ordering in ip neighbors list
fixwebfig - fixed switch port "default vlan id" has missing "auto" value
fixwebfig - fixed firewall connection-bytes option
fixipsec - fixed kernel failure after underlying tunnel has been disabled/enabled
featureromon - allow to see device identity if it is longer than 31 character
otherfastpath - show fp counters in /interface monitor aggregate
fixbridge firewall - fix chain check (broken since 6.33.2)
fixbridge firewall - fixed crash when jump rule points to disabled custom chain
fixsmb - fix crash when changing user which has open session
otheraddress-list - properly remove unused address-lists from drop-downs
fixfetch - fixed closure after 30 seconds
fixcapsman - fix radius accounting stop message
otherlog - reopen log file if deleted
fixpacking - fix tcp/udp checksums when simple packing is used
fixtile - fix ipsec freeze after SA updates
fixupnp - fixed missing in-interface option for dynamic dst-nat rules
fixtunnel - fix complaining about loop after ~248 days
othervrrp - make sure that VRRP gets state on bootup
fixppp - fixed rare kernel crash (introduced in v6.33)
featureppp - do not allow empty name ppp secrets
fixssh - fix active user accounting.
otheraddress-list - properly remove unused address-lists from drop-downs
otherarp - show incomplete ARP entries
fixbridge - fixed power-cycle-ping for bridge ports (was affecting all bridge)
fixbridge firewall - fixed crash when jump rule points to disabled custom chain
fixbtest - fix potential crash after btest release
fixcrypto - fixed kernel failure in talitos HW encryption
fixdhcpv6-client - fix DNS address assignement
fixethernet - fixed link resetting on power-cycle-ping value change
fixfastpath - fixed possible kernel failure on multi core systems
featurefetch - added 30 second connection time-out
fixfetch - fixed closure after 30 seconds
featurehotspot - added missing favicon.ico in hotspot html pages
fixhotspot - fixed missing image at login
fixipsec - fixed kernel failure after underlying tunnel has been disabled/enabled
fixlcd - fixed LCD crash on fast disable/enable
featureled - add WLAN led to RB951Ui
fixnetinstall - fix branding pack parsing
fixpacking - fix tcp/udp checksums when simple packing is used
featureppp - do not allow empty name ppp secrets
fixppp - fixed dynamic filter rule adding on some firewall filter configurations
featureromon - allow to see device identity if it is longer than 31 character
fixromon - fixed crash on RoMON if fast-path was active
fixsmb - fix crash when changing user which has open session
fixsmb - fixed SMB share crash when connection was cancelled
fixssh - fix active user accounting
fixssh - fix key exchange when first kex packet follows.
fixssh - fix session clean-up
fixtile - fix ipsec freeze after SA updates
fixtile - fixed kernel failure on HW encryption
fixupnp - fixed memory leak
fixupnp - fixed missing in-interface option for dynamic dst-nat rules
featurevrrp - allow VRRP to work behind firewall and NAT rules
fixvrrp - fix arp=reply-only
fixvrrp - fix enabling disabled vrrp interface when vrrp program has exited
fixvrrp - fixed on-backup script
fixwebfig - fixed firewall connection-bytes option
featurewinbox - added + & - to IGMP proxy MFC
featurewinbox - allow to specify traffic-monitor threshold in k & M units + specify that those are bits
fixwinbox - fixed tab names to correspond to console
fixwinbox/webfig - fixed version column ordering in ip neighbors list.
+30 more items in the release notesfixswitch - fixed CRS settings set back to defaults after a reboot
othernetinstall - include missing RB1200 drivers
fixfirewall - fixed connection-rate matcher
fixppp, pptp, l2tp, pppoe: fixed router dead locked if compression was enabled on link
otherquickset - create proper firewall rules when PPPoE is used for address acquisition
fixsstp - fixed kernel crash when other party started to fragment ppp packets in the middle
otherippool6 - optimize same prefix acquisition
otherwinbox - Shift+Ins & Shift+Del did not work in multi entry fields
featurewinbox - allow to specify ipv6 address in traffic flow target
featurewinbox - allow to specify eap-radius-accounting in CAPsMAN
featurewinbox - allow to enter dns name in email server
fixups - fix console oid print
fixtunnel - fix loopback keepalives on gre and ipip
otherpptp,l 2tp, sstp, pppoe: do not send data packets before we have negotiated connection with other
featurepptp, l2tp, sstp - make it work when add-default-route & dial-on-demand both are enabled
fixpptp, l2tp, sstp, pppoe clients - fixed problem where they failed to connect
fixnv2 - fixed kernel failure with frame size accounting
fixovpn client - fixed crash when ovpn didn't receive it's ip address
fixlcd - fix slideshow for CCR1072, and possible sign issues for temperatures
otherwinbox - make console notice correct screen size
featuressh - allow to specify pass as argument for private key import
otherwinbox - refetch hotspot walled garden hit counter
featurewinbox - added client-connections & server-connections to web proxy status
fixcerm - fix scep server certificate-reply degenerate PKCS#7 signed-data content
otherbgp - specific BGP networks were changed to different ones
featurecerm - allow export for all types except templates
otherwlan - update brazil-anatel country
fixwinbox - fixed context menu actions to apply to all selected items
fixbridge fastpath - fixed updating bridge FDB on receive (could cause TX traffic flooding on all bridge ports)
fixbonding fastpath - fixed possible crash when bonding master was also a bridge port
fixuser-manager - fixed zoom for user-manager homepage when mobile devices used
othertool fetch - don't trim [t]ftp leading slashes
fixconntrack - fixed problem with manual connection removal
otherwinbox - restrict change dynamic interface fields
fixromon - fixed crash on SACKed tx segments
fixroute - fixed crash on removing route that was aggregated
fixipsec - fixed crash in when gcm encryption was used
featureipsec - allow to set peer address as "::/0"
fixipsec - fixed empty sa-src address on acquire in tun mode
otheripsec - show proposal info in export ipsec section
otheripsec - preserve port wildcard when generating policy without port override
fixipsec - fix replay window, was accidently disabled since version 6.30
featureDynamic DNS servers can disappear when "allow-remote-requests" are not enabled
fixpptp & l2tp - fixed problem where android client could not connect if
fixlcd - fix crash (and 100% cpu usage) when interface gets removed from "stats-all" screen
fixtool fetch - fix incomplete ftp download
fixipsec - fixed crash in when gcm encryption was used
fixcertificate manager - fixed memory leak
fixtraffic flow - fixed dynamic input/output interface reporting
fixuser-manager - fixed username was not shown in /tool user-manager user
fixuser-manager - fixed zoom for user-manager homepage when mobile devices used
otherwinbox - restrict reversed ranges in dst-port under firewall
fixsnmp - fix system scripts table
fixquickset - fixed HomeAP mode
featureDynamic DNS servers can disappear when "allow-remote-requests" are not enabled
fixquickset - fixed HomeAP mode
fixlte - Fixes bug that causes Sierra Wireless modems with LTE interface to change interface name
fixtrafflow: fix in-interface reporting in flow
otheripsec - disallow changing dynamic peer
fixquickset - crashes introduced in 6.30 fixed
fixfixed :execute file=
fixbonding: fix arp monitoring in active backup mode
fixfixed vpls bridging (introduced in v6.29)
fixfixed problem where some CRS could not be reached (introduced in v6.29)
otheremail - increase server greeting timeout to 60s
otherlte - ZTE MF823 may loose configuration
otheruserman - update paypal root certificate
othertimezone - updated timezone information to 2015b release
fixcm2 - fixed capsman v2 100% CPU and other stability improvements
otherroute - using ldp could cause connected routes with
featureadded support for SiS 190/191 PCI Ethernet adapter
othermade metarouter work on boards with 802.11ac support or usb LTE
featuresstp server - allow ADH only when no certificate set
othermake fat32 disk formatting support disks bigger than 134GiB
fixfixed tunnels - could crash when clamp-tcp-mss was enabled
featureadded basic counters for ipv4/bridge fast path, also show status wether fast
fixtrafflow: - fixed crash on disable
fixpppoe over eoip - fixed crash with large packets
fixtilegx - fixed memory leak when queue settings are changed
fixar9888 - fixed crash when hw reports invalid rate
fixconsole - fixed "in" operator in console
otherconsole - make "/system package update print" work again.
fixtile - rare situation when CCR devices failed to auto-negotiate ethernet link (introduced in v6.25)
otherdhcpv4 client - it is now possible to unset default clientid and hostname options
featureinitial RoMon (Router Management Overlay Network) support added.
featureconsole - added 'comment' parameter for '/system script'
otherapi - return sentences can have property ".section" that groups values
featurecloud - add time zone detection feature "/system clock time-zone-autodetect"
othercloud - rename "/ip cloud enabled" to "/ip cloud ddns-enabled"
othercloud - make "/ip cloud update-time" independent from "/ip cloud ddns-enabled"
othercloud - when setting "/ip cloud ddns-enabled" to "no" router will send
othercloud - "/ip cloud force-update" command now will work also when
otherRB4xxGL - improved ethernet throughput (less dropped packets)
fixRouterBOARD - fixed health reporting
fixcheck-installation: fixed wrong kernel crc on powerpc boards
fixwatchdog: fix software watchdog for x86
otherssh - check conn state before sending disconnect message
fixipsec - fixed crash that happened in specific situation
fixssh - fixed ssh related crashes
featureovpn - allow to add VLANs to ovpn server bindings
featuresstp - added pfs option which enables DHE
otherpppoe client - increased timeout when searching for servers
fixsstp - fixed problem were Windows 8 clients couldn't connect
fixconsole - fixed some missing export entries
fixsmb - improved stability, fixed some crashes and problems causing disconnects
fixapi - fixed /system check-installation
fixcerm - fix scep client ca caps parsing
featureRouterBOARD - included new RouterBOOT 3.22 to enable protected-routerboot setting (see wiki)
fixwebfig - fixed various design skin issues
otherNTP client - accepts ipv6 as a server address
otherCCR improvements in link detection for SFP/SFP+ and auto-negotiation for SFP interfaces
otherknown issue - /system check-installation incorrectly reports error on PPC
fixcertificates - fix SCEP RA operation and SCEP client when operating with RA
otherppp - report authentication failure cause like in v6.6
featureovpn server - added support for address lists
otherimproved boot times
fixapi - fixed missing return values of some commands
securityntp - fixed vulnerabilities
othermpls/vpls have improved per core balancing on CCRs
fixfixed queue tree no-mark matching (was broken since 6.24)
fixfixed nested simple queues (was broken since 6.24)
fixfixed occasional crash when ipv6 was used
fixfixed route cache overflow (ipv4/ipv6 stops working) if ipsec is used
fixfixed Omnitik upgrade from v5 where wireless config was not correctly saved
fixfixed Webfig Design Skin where some skin changes were not saved
featureWPS support added to CM2 wireless package
securityntp - fixed vulnerabilities
fixweb proxy - fix problem when dscp was not set when ipv6 was enabled
fixfixed problem where some of ethernet cards do not work on x86
otherimproved CCR ethernet driver (less dropped packets)
otherimproved queue tree parent=global performance (especially on SMP systems and CCRs)
othereoip/eoipv6/gre/gre6/ipip/ipipv6/6to4 tunnels have improved per core balancing on CCRs
fixfixed tx for 6to4 tunnels with unspecified dst address
fixfixed vrrp - could sometimes not work properly because of advertising bad set of ip addresses
fixfixed problem where some of ethernet cards do not work on x86
fixpptp - fixed problem where tunnel stopped transmitting packets under heavy load
otherweb proxy - caching in RAM for boards with 32MB or less RAM will not cache any content
featureleds - removed 'led' command and added support for 'on', 'off' types under 'system leds'
featurefiles - allow to move files between different disks in winbox
fixdhcpv4 server - fix adding address lists from radius
otherdhcpv4 server - make radius classless static route tag as dhcp vendor specific
fixsmb - fixed HDD used/free space reporting
othermade powerpc metarouters work again (were broken in v6.22)
fixdisks - fixed fat32 formatting where some bogus files with strange names were created
fixdisks - fixed problem where some of USB disks were not recognized
featurefetch - allow checking certificate trust without crl checking
fixuserman - fix more web session problems when user uses
fixsnmp - fix external storage info reporting
fixsnmp - fix bulk walk problem introduced in v6.20
fixfix tunnels - keep keepalive disabled for existing tunnels when upgrading
fixfix tunnels - mtu for eoip tunnels was not allowed
otherusing routing-marks could lead to tunnel loop detection to turn off tunnels
featureovpn - added support for null crypto
featurefiles - allow to remove empty disk folders
fixsntp - fix problems with dns name resolving failures that were triggering
featureeoip/eoipv6/gre/gre6/ipip/ipipv6/6to4 tunnels have new features:
otherimproved connection-state matcher in firewall - can match multiple states in one rule, supports negation
featureadded connection-nat-state matcher - can match connections that are srcnatted,dstnatted or both
other100% CPU load caused by DNS service fixed
other100% CPU load caused by unclassified services fixed
other6to4 tunnel fixed
featurenew RouterBOOT firmware for Metal 2SHPn to improve wireless stability
fixfixed ugprading from v5
fixuserman - fix ~Your session has been reset due to inactivity~ error
othertimezone - updated timezone information to 2014i release
fixwireless - fixed scanning tool crash for 802.11ac interfaces
fixwireless - fixed Nv2 kernel panic on 802.11ac interfaces
featurequickset - added vpn configuration to Wifi AP %26 Ethernet modes as well
otherlte - changed device identification for devices which regenerate MAC address
fixsstp - fixed disconnects on high traffic load
fixovpn client - fixed problem where ip address was not added to bridge interface in ethernet mode
otherwebfig - show properly Switch Port configuration
fixdisks - fixed support for MMC/SD cards
featurewinbox - added filtering by dscp to torch
fixcertificate - fix CRL handling in trust chain
fixfixed 6to4 tunnels having inactive routes
fixipsec - fix downgrade problem to v5
otheripsec - disallow template-policy-group=none in peer config and set it to 'default'
othermetarouter - some metaroutes didn't have their licenses
othertorch - possibility to filter by dscp
fixfixed - master port on AR8327 switches that is put into bridge could sometimes not work properly
fixfixed queues - could have huge latencies and smaller throughput than specified
otherinterfaces report last link up/down time and link down count
otherwireless - improvements for nv2 and 802.11ac
othersstp - make sstp work on i386 as well
otherippool - improve performance when acquiring address without preference
otherpartitions - copying partitions did not work on some boards
featurebridge - added "Auto Isolate" stp enhancement (802.1q-2011, 13.25.6)
otheripsec - when peer config is changed kill only relevant SAs
othervpls - do not abort BGP connection when receiving invalid 12 byte
fixdns-update - fix zone update
otherdhcpv4 server - support multiple radius address lists
featureconsole - added unary operator 'any' that evaluates to true if argument
otherCCR - improved performance
otherfirewall - packet defragmenting will only happen with connection tracking enabled
otherfirewall - optimized option matching order with-in a rule
otherfirewall - rules that require CONNTRACK to work will now have Invalid flag
otherfirewall - rules that require use-ip-firewall to work will now have invalid flag
otherfirewall - rules that have interface with "Slave" flag specified as in-/out-interface
otherfirewall - rules that have interface without "Slave" flag specified as in-/out-bridge-port
otherfirewall - rules with Invalid flags will now be auto-commented to explain why
otherl2tp - force l2tp to not use MPPE encryption if IPsec is used
othersstp - force sstp to not use MPPE encryption (it already has TLS one)
othersstp - make it work for x86 systems
featurewinbox - added dual PSU stats in health menu
otheripv6 - Gre6 can now correctly fragment large packets
othersimple queue performance optimisation/improvement for multi-core RouterOS devices (especially CCR)
othersstp - report TLS encryption as well
featuresafe mode - do not allow user with less permissions to disrupt active safe mode
otherconsole - print command does not try to reuse item numbers assigned by
fixconsole - fix compact export of some partially modified
otherapi - use the same syntax for property values as is used in 'print detail'
otherconsole - show internal numbers in the form returned by 'find' (like *9A0F)
fixipsec - fix addition of default policy template
otherconsole - values of type 'nil' were returning 'nil' as result of most
fixl2tp - fixed problem on CCR where server responded with wrong source address
otherconsole export - put qutes around item names that start with a digit
featuresntp client - added support for dns lookup of ntp servers
otherconsole - when exporting to file, use name ending in '.in_progress', and
fixbridge setups sometimes could crash on CCR devices
fixfixed port flapping in 1G mode on sfp-sfpplus1 on CRS226
fixfixed SXT ac model losing it's interface if changing regulatory settings in "routerboard" menu
fixCCR1009 - fixed crash, only affects CCR1009
feature802.11ac support added in wireless-fp package for QCA9880/9882 rev2 (-BR4A) chips
featureip cloud now allows to set which IP to use - detected (public) or local (private)
fixl2tp, pptp, pppoe - fixed possible packet corruption when encryption was enabled
fixovpn - fixed ethernet mode
othercertificates - use SHA256 for fingerprinting
fixipsec - fix AH proposal and problem when sometimes policy was not generated
othersnmp - support AES encryption (rfc3826)
featurel2tp server: added option to enable IPsec automatically
featurepoe-out: added power-cycle-ping and power-cycle-interval settings
othergps - increased retry duration to 30 seconds
othertime - on routerboards, current time is saved in configuration on reboot
othersntp - disabling/enabling client was causing dynamic-servers to be ignored
fixCCR - fixed rare file system corruption when none
featureipsec - allow multiple encryption algorithms per peer
otheremail - support tls only connections
fixsmb - fixed usb share issues after reboot
fixsnmp - fix v3 protocol time window checks
otherupdated timezone information
featurequickset - added VPN settings for HomeAP mode
otherlatency improvements on CCR devices
fixfixed upgrade from v5 - on first boot all the optional packages were disabled
fixfixed problem where sntp server could not be specified in winbox %26 webfig
othermetarouter - make openwrt work on ppc metarouter again
othersntp - 'mode' now is a read-only property, it is set to broadcast if no
fixsmb - fixed some SMB1 errors
otherwireless-fp package is now included in routeros one (disabled by default)
fixwebfig - fixed quickset, it didn't work with disabled wireless pacakge
fixsstp - fixed problem where session was closed every 2min
fixpptp,l2tp,pppoe - fixed problem where some of the static bindings
othereoip - lowered default MTU to avoid IP packet fragmentation
featureeoip - added clamp-tcp-mss setting with default=yes for new tunnels to avoid
fixfixed - bridge could sometimes get added without "running" flag
fixfixed - simple queues could sometimes crash router
fixfixed - simple queue stats freeze (empty winbox queue window)
featuressh server - allow none cipher
featureproxy - added 'anonymous' option which will skip adding X-* and Via headers
featuredhcp server - added option use-framed-as-classless and
fixquickset - fixed problem where address mode selection did not work in
fixipv6 address - fixed problem where changing advertise lost ipv6 connected route
featureconsole - comments are now accepted where new command can start, that is
otherbackup - backups by default are encrypted now (with user password).
otherfiles with '.sensitive.' in the filename require 'sensitive'
otherlcd - reduce CPU usage when displaying static screens
fixl2tp - fixed occasional server lockup
fixpptp - fixed memory leak
fixsstp - fixed crashes
fixl2tp - fixed "no buffer space available" problem
otheripsec - support IPv4 over IPv6 and vice versa
otherpppoe - report correctly number of active links
otherupdated timezone information
fixmany fixes for CRS managed switch functionality -
featureadded trunk support for CRS switches
featureadded policing support for CRS switches
featurewww - added support for HTTP byte ranges
otherlte - provide signal strength using snmp and make 'info once' work in console
fixipsec - fix aes-cbc hardware acceleration on CCR with key sizes 192 and 256
featurewireless - add auto frequency feature
fixovpn - fixed TLS renegotiation
otherovpn - make bridge mode work with big packets (do not leave extraneous padding)
fixovpn - fixed require-client-certifcate
otherppp - revert RADIUS NAS-Port behaviour, report tunnel interface id
otherppp - mppe encryption together with mrru locked the router
featuredhcp - added support for DHCP option 138 - list of CAPWAP IPv4 servers
featurequickset - added Guest Network setup to Home AP mode
otherconsole - no longer required to supply value of '/routing bgp instance vrf'
featureethernet - added option to enable rx/tx flow control
featureethernet - added ability to specify advertised modes for copper ports
fixfixed 100% cpu usage on CCRs
otherssl - not finding CRL in local store for any certificate in trust chain will cause connection to fail
featurelte - support for Huawei ME609 and ME909u-521
fixfix autosupout.rif generation after kernel panic
otherovpn - make it work again
otherovpn client - remove cipher=any %26 auth=any options
fixpptp - fixed where Windows %26 MacOS clients were disconnecting all the time
othersstp - make it work with Windows client with AES encryption
fixipv6 pool - fix dynamic prefix disappearing which may influence large
fixssh client - fix key agreement when sometimes wrong DH algorithm was selected
otherbgp - multipath eBGP now does not propagate BGP nexthop unless
breakingremoved 10/100 half duplex from autonegotiation advertisement on CCR
featurelcd - added option to change the color-scheme
otherupdated bootloader firmware
fixppp: fixed RADIUS accounting
fixppp: fixed IPV6-Prefix assigning
fixppp: fixed dial-on-demand
othersupport Android usb tethering interface
featureipsec - added aes-gcm icv16 encryption mode
otherwireless - improve rate selection for nstreme protocol
featurepoe - new poe controller firmware for RB750UP and OmniTIK UPA
featureipsec - added aes-ctr encryption mode
otherleds - inverted modem signal trigger, now it will trigger when the signal
featureipsec - added sha256 and sha512 support
otheripsec - proposal defaults changed to aes-128 and sha1 for both phase1 and phase2
othercertificate - support ip, dns and email subject alternative names
featuredhcpv4 server - added REMOTE_ID option variable for relayed packets
fixipsec - fix policy bypass on IPv6 gre, ipip, eoip tunnels when policy
fixuserman - fix crash on tilera
fixfixed hairpin nat on bridge with use-ip-firewall=yes
fixfixed vlan on bridge after reboot having 00:00:00:00:00:00 mac address
featureaddress-list - allow manually adding timeoutable entries
otheraddress-list - show dynamic entry timeout
fixfixed l2mtu changing on CCRs - could cause port flapping
otherdisabling/enabling ethernet ports did not work properly on CCRs
fixfixed port flapping on CCR - could happen when having other than
fixwinbox - fixed problem where all previous session opened windows were read only
othercertificate - no more 'reset-certificate-cache' and 'decrypt' commands
fixfixed arp-reply only with more than one ip address on interface
fixfixed RB400 not to reboot by watchdog during micro-sd format
fixweb proxy - fix SPDY server push handling
othercertificate - merged '/certificate ca issued', '/certificate scep client' and
otherconsole - :foreach command can iterate over keys and values in an array
featureadded support for new Intel 10Gb ethernet cards (82599)
fixcertificates - fixed certificate import
fixwireless - fixed crash when dfs was enabled on pre-n wireless cards
fixfixed port flapping on CCR
featuretftp - added data packet pipelining for read requests
otherconsole - exported physical interface configuration uses 'default-name'
otherconsole - report all constituent errors for parameters with multiple
othercertificates - merge '/certificate ca' into '/certificate'
otherlcd - backlight option is replaced with "/lcd backlight" command
featuredhcp server - added option to disable conflict-detection
otherconsole - ':return' does not trigger 'on-error=' action of ':do' command
fixroute - fixed crash that could be triggered by change in nexthop
otherroute - some imported VPNv4 routes were not using MPLS labels
otherroute - imported VPNv4 routes were not always updated or removed when
fixwinbox - fixed problem where all settings were read only on first open
otherovpn server - use only ciphers that are allowed not that client requested
fixssh client - fixed public key authentication
fixipsec - fix peer mathing with non byte aligned masks
fixfix routerboot upgrading if RouterOS is partitioned
featureadd support for second serial port on CCR boards
fixfix serial port baudrate selection on CCR boards
otherethernet interface stats that are behind switch chip
otherwireless - improved 802.11n wireless retransmission (doesn't effect nstreme/nv2)
featureovpn - allow to specify server via dns name
fixwinbox - fixed problem where ipv6 routes with non local link address gateway
fixfixed watchdog on mipsle boards
featuretraceroute - added count %26 max-hops parameters
featuretraceroute - added back use-dns parameter
fixfixed usb Yota LTE modem hangup
featureconsole - make newly added item names always immediately available
othergraphing - make sure that interface graphs gets preserved across reboots
securityssh - fixed denial of service
othertraceroute - show mpls labels as well
fixbug fix - sometimes some new interfaces could not be created properly any more (f.e. some pppoe clients could not connect)
featureconsole - added '/console clear-history' command that clears command-line
othersstp - limit packet queue for each device
fixRB2011L - fixed occasional gigabit switch-chip lockup
otheruser manager - will warn on 1MB and stop before reaching minimum of 500KB disk space
otherhotspot - do not account traffic to local hotspot pages
featureppp, hotspot - added ability to specify where to insert rate limiting queue
featurepptp, l2tp, sstp - allow to specify server via dns name
featuredhcp - added ability to specify where to insert rate limiting queue
otherwww proxy - support ipv6 parent proxy
fixwebfig - fixed problem when opening quickset page country
featuretraceroute - added mtr like pinging
fixfix queues - correct queue was not installed when last child removed
fixfix simple queues - sometimes some simple queues would stop
fixconsole - fixed issue with local variables having non-empty value
fixconsole - fixed command ":global name" without second argument to not
fixconsole - fixed passing local variables as argument to function
fixRB1200 - fixed crash when receiving over l2mtu size packets
featureconsole - added "on-error" argument to ':do' command that is executed
fixhotspot - fixed chap error after failed http-chap login (broken in v6.1)
featureconsole - added new ':return' command that interrupts execution of script
fixrouterboot - fixed upgrade from RouterOS (could fail on some units)
fixuserman - fixed payment gateway response notify processing
otherconsole - resolved issue with 'from-pool' propery in '/ipv6 address'
otherconsole - array value syntax in expressions '{1;2;3;4}' now can
featureconsole - added 'verbose' argument to '/import' command that enables
featureconsole - ':global', ':local' and ':set' commands have new parameter 'do'
otherconsole - global variables now are common to all users and are
fixconsole - fixed parameter passing to scripts. Script parameters can
otherconsole - '$var 1 2 a="a" b="b"' syntax for passing parameters to commands
fixipsec - fixed peer address matching
otherups - query smart ups capabilities before issuing any commands
otherimproved CCR responsiveness on other interfaces when one interface is under attack
featuresms tool - added sim-pin setting
featuredhcp server - framed routes are now also added to the server routing table
featuredhcpv6 server - added binding-script option
featureproxy - allow multiple src-address for ipv4 and ipv6
fixeoip,gre tunnels could occasionally crash multicore router
fixfixed bug - sometimes some types of interfaces would stop working
fixipsec sometimes could crash kernel on CCR
fixconnection tracking sometimes could crash kernel on CCR
featureppp,pptp,l2tp,sstp - added default-route-distance parameter
fixipsec - fix phase1 autonegotiation on little endian platforms
featurepppoe server - allow service with empty service-name to accept all pppoe clients
fixwww, hotspot - fixed problem when www service stopped responding on high load
featurewinbox, webfig: allow to enter space in the text fields
fixwebfig - fixed configuration of VPLS %26 routing filters
featurelcd - added option for enabling or disabling the touch screen
featurelcd - added options for screen switching
featurelcd - up to 10 non-physical interfaces can now be added to the lcd
featurewinbox - added ability to fully set up traffic generator in winbox
featuretrafficgen - allow ranges for ip addrs and udp ports
featuretrafficgen - add tcp header support
fixqueue simple - fixed bug - actual queue order sometimes was wrong
fixfixed crash when setting master-port on AR8327 switch chips
fixfixed addresslist - dynamic entries sometimes would still
featureadded /ip settings allow-hw-fast-path setting to control AR8327N hardware ipv4 fast path
featurevrrp - allow more than one vrrp on interface
+9 more items in the release notesfixpptp, l2tp - fixed crash when tunnel mru was too big and fragmented ip packet
fixhotspot - fixed problem when after upgrade hotspot html directory was empty
otheripv6 nd - dns dynamic-servers were not included in router advertisements
fixwinbox - fixed problem Switch menu disappeared on RB2011
fixfixed memory amount issue on RB1100AHx2
otherconsole - '/import' prints each command that is executed
featureconsole - 'import' has new argument 'from-line' that starts executing
fixsecure api - fixed problem when wrong client ip address was reported
fixhotspot - fixed universal client
featureapi - added support for API over TLS (SSL)
otherapi - api service is now enabled by default
otherppp - do not show R flag for locally authenticated users
fixvrrp - fixed ah authentication
featurewebfig - added support for RADIUS authentication (via MS-CHAPv2)
otheripsec - for peers with full IP address specified system will
featuretrafficgen - added inject-pcap command for replaying pcap files into network
otherdns - retry queries with tcp if truncated results received
otherimproved queue statistics updating
fixfix 1G linking with some Cisco devices (affects RB7xx, RB9xx, RB1100, RB2011, CCR)
featureipsec - added /peer passive option which will prevent starting ISAKMP negotiation
otherRouterBOARD - default wireless config now includes password - serial number
otherlte - support YOTA WLTUBA-107
fixconsole - fixed crash when variable name was not specified for
featurehotspot - added mac-cookie login method
otherlcd - show a message when system shutdown is complete
featurelcd - added Log screen which is accessible through the Main Menu
featureipsec - added pre-shared-key-xauth and rsa-signature-hybrid
otherincreased max l2mtu on CCR to 10226 bytes
fixfixed crash on RB1200
fixfixed bonding - did not work after remove, undo
fixfixed queues - router could become unresponsive when configuring queues
securityssh - fixed denial of service
otherweb proxy - speed up startup
fixmetarouter - fixed occasional lockups on mipsbe boards
otherwireless - update required when using small width channel RB2011 RB9xx
otherweb proxy - speed up startup
fixmetarouter - fixed occasional lockups on mipsbe boards
otherwireless - update required when using small width channel RB2011 RB9xx
fixl2tp - fixed problem with reconnects when it added multiple ip addresses
fixwireless - fixed AES encryption speed issues (upgrade suggested)
otherlcd - changed gamma, which gives greater contrast
fixfix reboot when running on third party hypervisors
fixppp client - fixed possible loss of configuration after reboot for some modems
fixfixed wifi led order on "SXT Lite5"
fixuserman - fix PayPal "bad HTTP response"
fixkvm - fixed possible ROS guest incomplete package installation
featurel2tp server - added keepalive-timeout setting
fixwireless - fixed RADIUS mac-caching
fixwireless - fixed rare nv2 link stall
fixmetarouter - fixed system occasional lockup for 12s on RB4xx and RB7xx
fixmetarouter - fixed crash when FPU exception was raised in one of powerpc metarouters
featurequickset - added HomeAP mode
fixfixed "export compact" in "ip proxy"
fixroute - fix dst-prefix filtering did not return routes when routes with
otherwireless - improved nv2 stability
featurewinbox & webfig - added simple new version downloading & upgrading panel
otherdhcp server - immediately store to disk changes for lease configuration
otherlcd - improve graphs screen
otherlcd - improve touch screen (must /lcd reset-calibration)
fixsmb - fix smb share mounting on linux systems
fixovpn - fixed memory leak on disconnects
fixuserman - fix unpaid profile activation while authenticating
fixsstp - fix high CPU usage on SSL handshake
featurewinbox - added ability to add time & date to dashboard
fixmetarouter - fixed lockups on RB110AH
fixmetarouter - fixed occasional lockups on RB450G
fixups - fixed problem connecting to USB device, introduced in 5.20
featurequickset - added Wireless PTP Bridge mode
fixfix MPLS MTU configuration usage
fixdns - fix empty response
featuremanual upgrade to NEW beta poe controller firmware v2.0 for RB750UP and OmniTIK UPA
fixfix RB951-2n wireless issues
fixups - fixed resource leak
featuressh - added /ip ssh regenerate-host-key which will regenerate current host key
fixdhcpv6 client - fix multiple advertise handling
fixsnmp - fix v3 engineID discovery
fixfix ticking sound on RB411UAHL
fixuser manager - fixed byte to KiB, MiB and GiB conversion
fixfix routerboard firmware upgrade on RB951-2n
fixsniffer/torch + simple queues sometimes could crash router
fixfixed upgrade problem when it failed with error "disk is too small" while
fixfix health and poe access reliability on OmniTIK UPA and RB750UP boards
featuresstp - improve initial handshake to better handle many new connections
otherwireless - do not use bridge and WDS mode on AP-AP links, causes loops
fixdhcp ipv6 pd client - fixed ipv6 pool creation after reboot
featuredhcp ipv6 pd client - added option add-default-route
fixsstp - fixed connection idle time reporting
fixfix bad block count not to increase on Samsung K9F1208U0C nand
fixsnmp - fix dhcp lease table, snmp reported an incorrect information
fixfix RB1100 crash on interface disable/l2mtu change/reboot
otherdns could not resolve some domain names, was ignoring replies with DNAME RRs
fixfix firewall log action - sometimes was not logging mac addr
fixfiles - fixed problem when directories disappeared after reboot on usb or sd flash
otherwebfig - make QuickSet scan list work in Firefox v12
fixwebfig - fixed problem in QuickSet when changing country or channel-width in AP
fixwebfig - fixed skins when hiding first tab may make other tabs inaccessible
fixwinbox - fixed packet raw data view in packet sniffer
fixwinbox - fixed problem when router could be DoS attacked through winbox port
featureports - add option "/port firmware ignore-directip-modem"
featureipv6 pool - allow pools with prefix equal to prefix length
otherping times improved on Nv2 high data rate wireless links
featuretool email - added starttls option
featuresnmp - allow multiple ip ranges for each community
featureserial console - added channel support
fixwebfig - fixed problem when new item addition to status page in design skin mode
featureadd pw-type option for BGP VPLS
fixfixed mac telnet - sometimes did not work if more than one mac level path
fixuser - fixed problem when adding new users from console it's password was not set
otherreset packet mark when encapsulating/decapsulating from eoip,ipip,gre,eoipv6,ipipv6,gre6 tunnels
fixwinbox - fixed problem when changing main winbox window size and some of the inner windows
otherbackup - backup file creation failed if router identity name had / in it
otherwireless - improved nv2 link stability to reduce control frame timeouts
fixfixed rare configuration retention problems on RB1100AHx2
fixcertificate manager - fixed building certificate trust chain which caused
otherfirewall - to-address can be specified as ip address with mask in addition to
fixtraffic-generator - fix crash on multicore systems
fixsmb - fixes and improvements
featuresstp - added RC4 cipher support to fix interoperability issues
otherdhcp client - revert DNS settings on dhcp client disable
otherquickset - country & channel-width can now be specified
featurequickset - added support for configuring pppoe client on wireless interface
fixbridge - fixed problem where arp reply-only or disabled mode didn't work and
fixwebfig - fixed problem where none of table entries were shown if table filter
otherwebfig - show login page if autologin fails
otheruser manager - don't store backups in active store, always use path relative to /
featureconsole - allow to specify blank interval on x86 screens
otherconsole - changed 'password' command, now can be used from scripts and api
otherwinbox - reorganized window layout to match console better
fixssh - fixed interoperability problem with psftp based clients
featureimplemented simple SMB (windows file sharing) server
fixfixed ovpn-client - client stopped working if it was enabled/disabled at wrong time
fixfixed ipv6 - ipv6 neighbor discovery stopped working when
otherconsole - minor fixes and improvements
featureconsole - added support for compact export
featurehotspot - added login redirect through http status 302
featureleds - added default configuration for R5SHPn wireless card
fixppp - fixed problem were remote-ipv6-prefix was not given to user if remote-ipv6-pool was
otherwinbox, webfig - sort ethernet interfaces properly when more than 10 exist
featureadded QuickSet to RBSXT, RB411, RB711
otheruser manager - command to create and assign user profile from console
featureadded support for LTE modems (cdc ethernet type)
fixfix gre tunnels on x86 and other little endian machines