MikroTik RouterOS 6.33.6 → 6.46.8
27 releases · 2 breaking changes · 17 security fixes · 23 advisories fixed
17security2breaking0deprecated130feature342fix
Vulnerabilities fixed by this upgrade
- 7.5 CVE-2020-20021 An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.
- 9.8 CVE-2017-20149 The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by s…
- 6.5 CVE-2020-20221 Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticated remote attacker can cause a Denial o…
- 6.5 CVE-2020-20247 Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute process. An authenticated remote attacker can cause a Denial of Service due…
- 7.5 CVE-2019-16160 An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.
- 7.5 CVE-2020-10364 The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write sys…
- 3.7 CVE-2019-3981 MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover the user's username and MD5 hashed pass…
- 8.8 CVE-2019-3976 RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs…
- 7.5 CVE-2019-3977 RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can tr…
- 7.5 CVE-2019-3978 RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the att…
- 7.5 CVE-2019-3979 RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router adds all A records to its DNS cache even when the records are unrelated to the…
- 6.5 CVE-2019-15055 MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to…
- 6.5 CVE-2019-13954 Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server and in som…
- 6.5 CVE-2019-13955 Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursi…
- 7.5 CVE-2019-13074 A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of uncontrolled resource mana…
- 8.1 CVE-2019-3943 MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Win…
- 7.5 CVE-2019-3924 MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients…
- 8.8 CVE-2018-1156 Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker…
- 6.5 CVE-2018-1157 Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system…
- 6.5 CVE-2018-1158 Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.
- 6.5 CVE-2018-1159 Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. An authenticated remote attacker can crash the HTTP server by rapidly authenticating and disconnecting.
- 9.1 CVE-2018-14847KEV MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability…
- 9.8 CVE-2018-7445KEV A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gai…
Breaking changes
- breaking ipv6 - fixed address becoming invalid when interface was removed from bridge/mesh in 6.38.7
- breaking certificates - fixed crash when crl is removed while it is being fetched in 6.37.4
Security changes
- security smb - fixed possible memory leak (CVE-2020-11881) in 6.46.7
- security wireless - fixed potential wireless driver issue related to CVE-2020-3702 in 6.46.7
- security winbox - made "none" the default value for "Security Profile" parameter when creating a new "Wirelees->Connect list" entry in 6.45.9
- security security - fixed vulnerability for routers with default password (limited to Wireless Wire), admin could login on startup with empty password before default configuration script was fully loaded in 6.45.8
- security Fixes CVE-2020-20221: Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticated remote attacker can cause a Denial o… in 6.44.6
- security MAJOR CHANGES IN v6.44.6: ---------------------- !) package - accept only packages with original filenames (CVE-2019-3976); !) package - improved package signature verification (CVE-2019-3977); !) security - fixed improper handling of DNS responses (CVE-2019-3978, CVE-2019-3979);… in 6.44.6
- security system - accept only valid string for "name" parameter in "disk" menu (CVE-2019-15055) in 6.44.6
- security MAJOR CHANGES IN v6.44.5: ---------------------- !) security - fixed vulnerabilities CVE-2019-13954, CVE-2019-13955; !) security - fixed vulnerabilities CVE-2019-11477, CVE-2019-11478, CVE-2019-11479; !) security - fixed vulnerability CVE-2019-13074; ---------------------- in 6.44.5
- security conntrack - fixed GRE protocol packet connection-state matching (CVE-2014-8160) in 6.44.5
- security ovpn - added "verify-server-certificate" parameter for OVPN client (CVE-2018-10066) in 6.44.5
- security www - improved client-initiated renegotiation within the SSL and TLS protocols (CVE-2011-1473) in 6.44.5
- security Fixes CVE-2019-3924: MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients… in 6.42.12
- security MAJOR CHANGES IN v6.40.9: ---------------------- !) security - fixed vulnerabilities CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159; ---------------------- in 6.40.9
- security winbox - hide "wps-mode" & "security-profile" in wireless nv2 mode in 6.38.7
- security Fixes CVE-2017-20149: The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by s… in 6.37.5
- security webfig - added extra protection against XSS exploits in 6.37.4
- security wireless - show comment on "security-profile" if it is set in 6.37.4
Every release in between
fixcap - fixed L2MTU path discovery
fixchr - fixed file system quiescing
fixcrs3xx - fixed IGMP snooping for CRS312, CRS326-24S+2Q+ and CRS354 devices
fixcrs3xx - fixed switch rules for CRS309 and CRS317 devices (introduced in v6.46.7)
othercrs3xx - improved system stability on CRS354 devices
fixdefconf - fixed default configuration loading on RBmAP-2nD
otherdefconf - improved default configuration generation on devices with changed wireless interface names
otherdhcpv6-server - improved stability when changing server for static bindings
otherdhcpv6-server - properly save bindings when executing "make-static" command
fixfetch - fixed "src-address" usage for SFTP
otherfetch - improved SSL handshake processing
otherhotspot - do not verify Hotspot interface status when detecting if HTTP/HTTPS login method is allowed
fixleds - fixed LED type setting
fixlte - fixed multiple APN passthrough on R11e-4G
otherlte - limit allowed APN count to 3 on R11e-LTE
fixmpls - fixed duplicate "LabelRelease" message sending
otherospf - optimized LSA printing for smaller message sizes
fixpoe - fixed automatic PoE firmware upgrade procedure
otherpoe - improved PoE-out status detection
featureppp - allow specifying pool name for "remote-ipv6-prefix-pool" parameter
featureradius - added "Service-Type" attribute to Access-Request for IPv4 and IPv6 DHCP servers
othersmips - reduced RouterOS main package size
fixsms - fixed SMS sending when both "interface" and "smsc" parameters are specified
fixsnmp - fixed "/tool snmp-get" functionality (introduced in v 6.46beta43)
fixswitch - fixed Ethernet padding for small packets
otheruser - improved WinBox and The Dude authenticated session handling
otheruser-manager - updated PayPal's root certificate authorities
othervrrp - made "password" parameter sensitive
otherw60g - general stability and performance improvements
featurewireless - added support for US FCC UNII-2 and Canada country profiles for NetMetal series devices
fixwireless - fixed incorrect wireless capability information in association response frames
otherwireless - updated "kazakhstan" regulatory domain information
fixbridge - fixed host table update on SNMP query
fixbridge - fixed STP alternate and backup port states for devices with switch chip
fixcrs3xx - fixed hardware offloaded MPLS forwarding when using bonding interfaces
fixcrs3xx - fixed QSFP+ interface LEDs when using break-out cable for CRS326-24S+2Q+
fixcrs3xx - fixed switch ACL rules for CRS312, CRS326-24S+2Q+ and CRS354 devices
fixcrs3xx - fixed switch port "egress-rate" removal for CRS305, CRS326-24G-2S+, CRS328, CRS318 devices
fixdefconf - fixed default configuration loading on RBmAPL-2nD
fixdot1x - fixed duplicate EAP request packets for server
fixdot1x - fixed EAP packet version numbering
featureemail - added support for multiple "to" recipients
fixexport - fixed HotSpot "address-per-mac" parameter export
fixftp - fixed possible buffer overflow
fixike2 - fixed local side NAT detection
fixike2 - fixed policy reference for pending acquire
featureinterface - added new builtin "static" interface list
fixkidcontrol - fixed "time-unlimited-rate" to engage in correct time
fixlte - fixed modem initialization when multiple modems are used simultaneously
fixlte - fixed PDP authentication configuration for SIM7600
fixmetarouter - fixed image importing (introduced in v6.46)
fixospf - fixed disappearing NSSA default route
fixospf - fixed processing of "unknown" LSA type
fixpoe - fixed "power-cycle" functionality on hEX PoE, PowerBox Pro and OmniTIK 5 PoE ac
featureprofile - added support for CCR2004-1G-12S+2XS
fixqsfp - fixed auto-negotiation status
fixquickset - fixed invalid configuration applying when performing changes during LTE modem initialization process
fixrouterboard - fixed "reset-button" menu presence on all devices
fixrouterboot - fixed etherboot FCS errors with 100Mbps rate for CRS305, CRS309 and CRS317 devices ("/system routerboard upgrade" required)
fixsmb - fixed file path validation (introduced in v6.46)
securitysmb - fixed possible memory leak (CVE-2020-11881)
featuresniffer - allow setting port for "streaming-server"
featuresnmp - added "dot1qTpFdbTable" OID reporting for Q-BRIDGE-MIB
featurew60g - added "mdmg-fix" parameter for RBwAP60Gx3 (CLI only)
featurewinbox - added "region" parameter for W60G interfaces
featurewinbox - allow to specify any Ethernet like interface under "Tool/WoL" menu
featurewinbox - do not allow to enter empty strings in "caps-man-names" and "common-name" parameters
featurewireless - added support for U-NII-2 for cAP ac
featurewireless - added support for U-NII-2 for wAP ac
featurewireless - allow setting "tx-power" up to 40
securitywireless - fixed potential wireless driver issue related to CVE-2020-3702
featurewww - added "tls-version" parameter in "IP->Services" menu
+37 more items in the release notesotherarm - improved watchdog and kernel panic reporting in log after reboots on RB3011 and IPQ4018/IPQ4019 devices ("/system routerboard upgrade" required)
fixcapsman - fixed "certificate" parameter updating on CAP
fixcertificate - fixed certificate verification when flushing CRL's
featurechr - added support for file system quiescing
featurechr - enabled support for VMBus protocol version 4.1
otherchr - improved system stability when running CHR on Hyper-V
otherconsole - prevent incorrect type interfaces appearing in command hints
fixcrs3xx - fixed frame forwarding after disabling/enabling bridge hardware offloading for CRS354-48G-4S+2Q+ device
fixcrs3xx - fixed interface statistics for CRS354-48G-4S+2Q+ and CRS354-48P-4S+2Q+ devices
fixcrs3xx - fixed switch rule "dst-port" parameter for IPv6 traffic on CRS305-1G-4S+, CRS326-24G-2S+, CRS328-24P-4S+, CRS328-4C-20S-4S+, netPower 15FR devices
featuredefconf - added welcome note with common first steps for new users
fixhealth - fixed maximum SFP temperature reading under '/system health' menu
fixhotspot - fixed redirect to log in page (introduced in v6.45)
featureled - added "dark-mode" functionality for CRS105-5S-FB
featurelte - added "phy-cellid" value support for LTE-US
fixlte - fixed IP type selection from APN on RBSXTLTE3-7
fixsniffer - fixed minor typo in "host" menu
fixsnmp - fixed "ifSpeed" reporting for tunnel interfaces
fixsnmp - fixed "routeros-version" value returning from registration table
fixsnmp - fixed UPS battery voltage value scaling
featuressh - added support for RSA keys with SHA256 hash (RFC8332)
fixsystem - improved system stability when forwarding traffic from switch chip to CPU (introduced in v6.43)
featurewebfig - added default configuration confirmation window to WebFig
featurewebfig - allow skin designing without "ftp" and "sensitive" policies
featurewinbox - added "Options" parameter support for DHCPv6 client and server
featurewinbox - added 160Mhz extension channel support for CAPsMAN
featurewinbox - added support for "Tools->WoL" menu
fixwinbox - fixed "ARP" parameter inheritance from "CAPs Configuration" configuration
fixwinbox - fixed "Bands" parameter display for LTE interfaces
fixwinbox - fixed "DSCP" parameter value setting
fixwinbox - fixed "Frequency" and "Secondary Frequency" parameter inheritance from "CAPs Channel" configuration
fixwinbox - fixed "Passthr. MAC Address" parameter display "LTE APNs" menu
fixwinbox - fixed "Switch" menu on CRS354-48P-4S+2Q+
fixwinbox - fixed "dst-port" unsetting in "IP->Hotspot->Walled Garden" menu
fixwinbox - fixed "invalid" flag presence under "System/Certificates/CRL" menu
fixwinbox - fixed automatic "IPv6->Firewall->Address List" table update
securitywinbox - made "none" the default value for "Security Profile" parameter when creating a new "Wirelees->Connect list" entry
featurewireless - added "skip-dfs-channels" parameter
featurewireless - allow using FCC "U-NII-2" frequency range for hAP ac2 and RBwAPGR series devices
fixwireless - fixed default "antenna-gain" setting on SXT 2 devices
+20 more items in the release notesfixcapsman - fixed background scan showing incorrect regulatory domain mismatch error (CAP upgrade required)
othercapsman - improved radar detection algorithm
otherchr - improved stability when changing ARP modes on e1000 type adapters
fixconsole - fixed "clear-history" restoring historic actions after power cycle
otherconsole - removed "edit" and "set" actions from "System/History" menu
otherconsole - updated copyright notice
othercrs305 - disable optical SFP/SFP+ module Tx power after disabling SFP+ interface
otherdhcpv4-server - improved stability when RADIUS interim update is sent
fixdhcpv6-client - fixed timeout when doing rebind
otherdhcpv6-client - properly update bind time when unused prefix received from the server
otherdhcpv6-client - properly update IPv6 address on rebind
fixdhcpv6-server - fixed logged error message when using "address-pool=static-only"
otherdhcpv6-server - ignore prefix-hint from client's DHCPDISCOVER if static prefix received from RADIUS
fixhealth - fixed health reporting on OmniTIK 5 PoE ac
otheripsec - improved system stability when processing decrypted packet on unregistered interface
otherl2tp - improved system stability when disconnecting many clients at once
fixled - fixed default LED configuration for RBLHG-2nD and RBLHG-5HPnD
otherlte - show SIM error when no card is present
fixppp - fixed connection establishment when receiving "0.0.0.0" DNS
fixppp - fixed minor typo in "ppp-client" monitor
otherppp - prioritize "remote-ipv6-prefix-pool" from PPP secret over PPP profile
otherqsfp - do not report bogus monitoring readouts on modules without DDMI support
otherqsfp - improved module monitoring readouts for DAC and break-out cables
featurerouterboard - added "mode-button" support for RBcAP2nD
securitysecurity - fixed vulnerability for routers with default password (limited to Wireless Wire), admin could login on startup with empty password before default configuration script was fully loaded
fixssh - fixed output printing when "command" parameter used
othertimezone - updated time zone database to version 2019c
othertraffic-generator - improved memory handling on CHR
fixw60g - fixed "monitor" command on disabled interfaces
featurewinbox - automatically refresh "Packets" table when new packets are captured by "Tools/Packet Sniffer"
otherwinbox - show "LCD" menu only on boards that have LCD screen
featurewireless - added "ETSI" regulatory domain information
featurewireless - added "indonesia4" regulatory domain information
featurewireless - added U-NII-2 support forRBSXTsqG-5acD, RBLHGG-5acD-XL, RBLHGG-5acD, RBLDFG-5acD, RBDiscG-5acD
featurewireless - allow using "canada2" regulatory domain on US lock devices
fixwireless - fixed sensor MAC address reporting in TZSP header
otherwireless - improved compatibility by adding default installation mode and antenna gain for devices with integrated antennas
otherwireless - improved compatibility for Switzerland wireless country profile to improve compliance with ETSI regulations
otherwireless - improved IPQ4019, QCA9984, QCA9888 wireless interface stability
securityFixes CVE-2020-20221: Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticated remote attacker can cause a Denial o…
securityMAJOR CHANGES IN v6.44.6: ---------------------- !) package - accept only packages with original filenames (CVE-2019-3976); !) package - improved package signature verification (CVE-2019-3977); !) security - fixed improper handling of DNS responses (CVE-2019-3978, CVE-2019-3979);…
fixcapsman - fixed frequency setting requiring multiple frequencies
fixcapsman - fixed newline character missing on some logging messages
otherccr - improved packet processing after overloading interface
fixcrs312 - fixed combo SFP port toggling (introduced in v6.44.5)
othercrs328 - adjust fan speed based on SFP and CPU temperature
othercrs3xx - correctly display link rate when 10/100/1000BASE-T SFP modules are used in SFP+ interfaces
fixcrs3xx - fixed management access when using switch rule "new-vlan-priority" property
fixexport - fixed "bootp-support" parameter export
otherhealth - improved fan control on CRS3xx and CCR1016-12S-1S+r2
fixike2 - fixed policy port selection for responder with natted initiator
fixike2 - fixed traffic selector address family selection when using IPv6
fixinterface - fixed missing PWR-LINE section on PL7411-2nD and PL6411-2nD (introduced v6.44)
featureipsec - allow inline "passphrase" parameter when importing keys
fixipsec - fixed minor spelling mistakes in logs
fixled - fixed default LED configuration for RBLHG5nD
fixospf - fixed opaque LSA type checking in OSPFv2
fixospf - fixed possible busy loop condition when accessing OSPF LSAs
otherospf - improved "unknown" LSA handling in OSPFv3
featureprofile - added "internet-detect" process classificator
fixradius - fixed open socket leak when invalid packet is received (introduced in v6.44)
fixsfp - fixed "sfp-rx-power" value for some transceivers
othersmb - improved stability on x86 and CHR
fixsnmp - fixed encrypted data sequence (introduced in v6.44.5)
othersnmp - improved reliability on SNMP service packet validation
otherssh - accept remote forwarding requests with empty hostnames
fixssh - fixed carriage return presence in subsequent sessions
fixssh - improved remote forwarding handling (introduced in v6.44.3)
fixsupout - fixed supout file generation outside of internal storage with insufficient space
fixswitch - fix port isolation for non-CRS series switch chips
securitysystem - accept only valid string for "name" parameter in "disk" menu (CVE-2019-15055)
othersystem - improved system stability for devices with AR9342 SoC
fixupgrade - fixed "auto-upgrade" to use new style authentication
fixupnp - fixed XML parsing (FG-VD-19-110)
otherwatchdog - renamed "no-ping-delay" parameter to "ping-start-after-boot"
featurewinbox - added "auto-erase" parameter to "Tools/SMS" menu
featurewinbox - added "https-redirect" parameter to "IP/Hotspot/Profiles menu"
featurewinbox - added "revision" parameter to "System/Routerboard" menu
otherwinbox - removed "max-sms" parameter from "Tools/SMS" menu
+4 more items in the release notessecurityMAJOR CHANGES IN v6.44.5: ---------------------- !) security - fixed vulnerabilities CVE-2019-13954, CVE-2019-13955; !) security - fixed vulnerabilities CVE-2019-11477, CVE-2019-11478, CVE-2019-11479; !) security - fixed vulnerability CVE-2019-13074; ----------------------
otherbridge - correctly handle bridge host table
fixcapsman - fixed CAP system upgrading process for MMIPS
fixcapsman - fixed interface-list usage in access list
othercertificate - removed "set-ca-passphrase" parameter
othercloud - properly stop "time-zone-autodetect" after disable
securityconntrack - fixed GRE protocol packet connection-state matching (CVE-2014-8160)
otherdefconf - automatically set "installation" parameter for outdoor devices
fixdhcpv6-client - fixed status update when leaving "bound" state
fixdhcpv6-server - fixed dynamic IPv6 binding without proper reference to the server
otherdhcpv6-server - override prefix pool and/or DNS server settings by values received from RADIUS
fixdiscovery - fixed CDP packets not including address on slave ports (introduced in v6.44)
othere-mail - properly release e-mail sending session if the server's domain name can not be resolved
fixfirewall - fixed fragmented packet processing when only RAW firewall is configured
otherfirewall - process packets by firewall when accepted by RAW with disabled connection tracking
othergps - strip unnecessary trailing characters from "longtitude" and "latitude" values
otherhotspot - moved "title" HTML tag after "meta" tags
otheripv6 - improved system stability when receiving bogus packets
securityovpn - added "verify-server-certificate" parameter for OVPN client (CVE-2018-10066)
otherrb3011 - improved system stability when receiving bogus packets
otherrb921 - improved system stability ("/system routerboard upgrade" required)
othersnmp - improved reliability on SNMP service packet validation
fixssh - fixed non-interactive multiple command execution
featuresupout - added IPv6 ND section to supout file
featuresupout - added "pwr-line" section to supout file
othersupout - changed IPv6 pool section to output detailed print
featurewinbox - do not allow setting "dns-lookup-interval" to "0"
otherwireless - improved DFS radar detection when using non-ETSI regulated country
otherwireless - improved installation mode selection for wireless outdoor equipment
otherwireless - updated "china" regulatory domain information
securitywww - improved client-initiated renegotiation within the SSL and TLS protocols (CVE-2011-1473)
fixw60g - fixed memory leak (introduced in v6.43.15)
fixdhcpv4-server - fixed commenting option for alerts
fixdhcpv6-server - fixed binding setting update from RADIUS
otherike1 - improved stability for transport mode policies on initiator side
otheripv6 - adjusted IPv6 route cache max size
otheripv6 - adjust IPv6 route cache max size based on total RAM memory
otheripv6 - improved IPv6 neighbor table updating process
otherlte - reset LTE modem only when SIM slot is changed on dual SIM slot devices
otherlte - use default APN name "internet" when not provided
otherrb2011 - removed "sfp-led" from "System/LEDs" menu
fixrb4011 - fixed SFP+ interface full duplex and speed parameter behaviour
otherrb4011 - improved SFP+ interface linking to 1Gbps
fixsmb - fixed possible buffer overflow
featuresnmp - added "radio-name" (mtxrWlRtabRadioName) OID support
otherssh - do not generate host key on configuration export
fixswitch - fixed possible crash when interface state changes and DHCP Snooping is enabled
othersystem - accept only valid path for "log-file" parameter in "port" menu
otheruserman - updated authorize.net gateway DNS name
otherwebfig - improved file handling
otherwinbox - improved file handling
otherwinbox - show "R" flag under "IPv6/DHCP Server/Bindings" tab
featurewireless - added support for US FCC UNII-2 and Canada country profiles for LHG-5HPnD-US, RBLHG-5HPnD-XL-US and SXTsq5HPnD-US devices
otherwireless - improved wireless country settings for EU countries, outdoor models will use outdoor frequency range by default
otherwireless - improved system stability for all devices with 802.11ac wireless
otherwireless - improved wireless country settings for EU countries
otheripv6 - adjust IPv6 route cache max size based on total RAM memory
otherbridge - count routed FastPath packets between bridge ports under FastPath bridge statistics
fixbridge - fixed BOOTP packet forwarding when DHCP Snooping is enabled
fixbridge - fixed packet forwarding with enabled DHCP Snooping and Option 82
fixbridge - fixed possible memory leak when using "ingress-filtering=yes" on bridge interface
fixbridge - fixed system's identity change when DHCP Snooping is enabled (introduced in v6.43)
othercapsman - always accept connections from loopback address
othercertificate - force 3DES encryption for P12 certificate export
fixdhcp - fixed dual stack queue addition
featuredhcpv6-server - allow to add DHCPv6 server with pool that does not exist
fixdhcpv6-server - fixed missing gateway for binding's network if RADIUS authentication was used
featureethernet - added "tx-rx-1024-max" counter to Ethernet stats
fixethernet - fixed packet forwarding when SFP interface is disabled on hEX S
otherfetch - improved file downloading to slow memory
othergps - increase precision for dd format
othergps - removed unnecessary leading "0" for dd format
fixipsec - fixed all policies not getting installed after startup (introduced in v6.43.8)
fixipsec - fixed stability issues after changing peer configuration (introduced in v6.43)
featureipv6 - do not allow setting "preferred-lifetime" longer than "valid-lifetime"
featurekidcontrol - added "tur-fri", "tur-mon", "tur-sat", "tur-sun", "tur-thu", "tur-tue", "tur-wed" parameters
fixkidcontrol - fixed validation checks for time intervals
fixled - fixed default LED configuration for RBSXTsq-60ad
fixlldp - fixed missing capabilities fields on some devices
otherlte - do not show "session-uptime" if session is not up
otherlte - improved SIM7600 initialization after reset
fixntp-client - fixed "dst-active" and "gmt-offset" being updated after synchronization with server
fixppp - fixed dynamic route creation towards VPN server when "add-default-route" is used
fixrb4011 - fixed ether10 failing to auto negotiate link speed to 1Gbps
featuresmb - added commenting option for SMB users (CLI only)
fixsmb - fixed macOS clients not showing share contents
fixsmb - fixed Windows 10 clients not able to establish connection to share
fixsupout - fixed "poe-out" output not showing all interfaces
fixsupout - fixed Profile output on single core devices
featurewinbox - added "conflict-detection" parameter in "IP/DHCP Server" menu
featurewinbox - added "coordinate-format" parameter in LTE interface settings
featurewinbox - added "use-local-address" parameter in "IP/Cloud" menu
featurewinbox - allow specifying interface lists in "CAPsMAN/Access List" menu
fixwinbox - fixed "IPv6/Firewall" "Connection limit" parameter not allowing complete IPv6 prefix lengths
fixwinbox - fixed "LCD" menu not shown on RB2011UiAS-2HnD
fixwireless - fixed antenna gain setting on RBSXT5nDr2
featurewireless - improved connection stability for new model Apple devices
+6 more items in the release notessecurityFixes CVE-2019-3924: MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients…
otheripsec - accept only valid path for "export-pub-key" parameter in "key" menu
fixquickset - fixed "country" parameter not properly setting regulatory domain configuration
fixsmb - fixed possible buffer overflow
fixw60g - fixed disconnection issues in PtMP setups
otherwireless - improved antenna gain setting for devices with built in antennas
otherwireless - show indoor/outdoor frequency limitations under "/interface wireless info country-info" command
fixcapsman - fixed "group-key-update" parameter not using correct units
othercertificate - properly flush old CRLs when changing store location
otherconsole - properly remove system note after configuration reset
otherdhcpv6-server - properly handle DHCP requests that include prefix hint
fixdiscovery - fixed malformed neighbor information for routers that has incomplete IPv6 configuration
fixdiscovery - fixed neighbor discovery for PPP interfaces
fixexport - fixed "silent-boot" compact export
featuregps - added "coordinate-format" parameter
otherinterface - improved system stability when including/excluding a list to itself
featurekidcontrol - do not allow users with "read" policy to pause and resume kids
fixled - fixed default LED configuration for RBMetalG-52SHPacn
otherlog - properly handle long echo messages
featurelte - added support for more ZTE MF90 modems
otherlte - disallow setting LTE interface as passthrough target
otherpackage - use bundled package by default if standalone packages are installed as well
fixresource - fixed "total-memory" reporting on ARM devices
featuresnmp - added "tx-ccq" ("mtxrWlStatTxCCQ") and "rx-ccq" ("mtxrWlStatRxCCQ") values
othersnmp - do not initialise interface traps on bootup if they are not enabled
fixswitch - fixed MAC learning when disabling interfaces on devices with Atheros8327 and QCA8337 switch chips
fixsystem - fixed situation when all configuration was not properly loaded on bootup
fixtimezone - fixed "Europe/Dublin" time zone
otherupgrade - automatically uninstall standalone package if already installed in bundle
otherwebfig - do not show bogus VHT field in wireless interface advanced mode
featurewinbox - allow to change VHT rates when 5ghz-n/ac band is used
otherwinbox - renamed "Radius" to "RADIUS"
otherwinbox - show "Switch" menu on RB4011iGS+5HacQ2HnD and RB4011iGS+
featurewireless - added new "installation" parameter to specify router's location
otherwireless - improved stability for 802.11ac
otherwireless - improvements in wireless frequency selection
otherbridge - do not learn untagged frames when filtering only tagged packets
fixbridge - fixed possible memory leak when VLAN filtering is used
otherbridge - improved packet handling when hardware offloading is being disabled
otherbridge - properly disable dynamic CAP interfaces
fixcertificate - fixed time zone adjustment for SCEP requests
othercrs328 - improved link status update on disabled SFP and SFP+ interfaces
othercrs328 - improved link status update on disabled SFP+ interface when using DAC
fixcrs3xx - fixed possible memory leak when disabling bridge interface
otherdefconf - automatically accept default configuration if reset done by holding button
fixdefconf - properly load default configuration after reset (introduced in v6.42.9)
fixhealth - fixed bad voltage readings on RB493G
fixipsec - fixed hw-aead (H) flag presence under Installed SAs on startup
otheripsec - improved stability when uninstalling multiple SAs at once
otheripsec - properly update warnings under peer menu
featureled - added "dark-mode" functionality for LHG and LDF series devices
fixled - fixed default LED configuration for SXT LTE kit and wAP 60G AP devices
fixled - fixed power LED turning on after reboot when "dark-mode" is used
fixntp - fixed possible NTP server stuck in "started" state
otherospf - improved stability while handling type-5 LSAs
otherromon - improved packet processing when MTU in path is lower than 1500
otherrouterboard - renamed SIM slots to "a" and "b" on SXT LTE kit
otherrouterboard - show "boot-os" and "force-backup-booter" options only on devices that have such feature
othertimezone - updated timezone information from tzdata2018g release
fixtraffic-flow - fixed post NAT port reporting
fixtraffic-flow - fixed "src-mac-address" and added "post-src-mac-address" fields
othertunnel - made "ipsec-secret" parameter sensitive
fixusb - fixed power-reset for hAP ac^2 devices
fixw60g - fixed misleading license level requirement log message
fixw60g - fixed "scan" functionality when in bridge mode
otherw60g - renamed "frequency-list" to "scan-list"
featurewinbox - allow to specify SIM slot on LtAP mini
featurewinbox - enabled "fast-forward" by default when adding new bridge
otherwinbox - show "System/Health" only on boards that have health monitoring
otherwinbox - show "W60G" wireless tab on wAP 60G AP
otherbridge - ignore tagged BPDUs when bridge VLAN filtering is used
otherbridge - improved packet handling when hardware offloading is being disabled
fixcrs317 - fixed packet forwarding on bonded interfaces without hardware offloading
fixcrs326/crs328 - fixed packet forwarding when port changes states with IGMP Snooping enabled
otherdefconf - properly clear global variables when generating default configuration after RouterOS upgrade
fixdns - fixed DNS cache service becoming unresponsive when active Hotspot server is present on the router (introduced in 6.42)
fixfilesystem - fixed NAND memory going into read-only mode (requires "factory-firmware" >= 3.41.1 and "current-firmware" >= 6.43)
featurehealth - added missing parameters from export
fixhealth - fixed voltage measurements for RB493G devices
otherhotspot - properly update dynamic "walled-garden" entries when changing "dst-host"
fixike2 - fixed rare authentication and encryption key mismatches after rekey with PFS enabled
otherike2 - improved subsequent phase 2 initialization when no child exist
otheripsec - improved invalid policy handling when a valid policy is uninstalled
otheripsec - improved stability when using IPsec with disabled route cache
featureled - added "dark-mode" functionality for wsAP ac lite, RB951Ui-2nD, hAP, hAP ac lite and LtAP mini devices
fixlte - fixed LTE interface not working properly after reboot on RBSXTLTE3-7
fixlte - fixed LTE registration in 2G/3G mode
otherospf - improved link-local LSA flooding
otherospf - improved stability when originating LSAs with OSPFv3
fixrouterboard - fixed memory tester reporting false errors on IPQ4018 devices ("/system routerboard upgrade" required)
otherrouterboard - show "boot-os" option only on devices that have such feature
fixrouterboot - fixed RouterOS booting on devices with particular NAND memory
othersniffer - made "connection", "host", "packet" and "protocol" sections read-only
featuresupout - added "files" section to supout file
fixupgrade - fixed RouterOS upgrade process from RouterOS v5 on PowerPC
otherupnp - improved UPnP service stability when handling HTTP requests
fixuserman - fixed "shared-secret" parameter requiring "sensitive" policy
featurew60g - added "frequency-list" setting
fixw60g - fixed interface LED status update on connection
fixw60g - fixed random disconnects
otherw60g - general stability and performance improvements
fixwebfig - fixed time interval settings not applied properly under "IP/Kid Control/Kids" menu
fixwebfig - fixed www service becoming unresponsive
otherwinbox - show "System/RouterBOARD/Mode Button" on devices that has such feature
otherwireless - accept only valid path for sniffer output file parameter
fixwireless - fixed "/interface wireless sniffer packet print follow" output
fixled - fixed unused "link-act-led" LED trigger on RBLHG 2nD, RBLHG 2nD-XL and RBSXTsq 2nD
otherled - removed unused "link-act-led" trigger for devices which does not use it
othernetinstall - sign Netinstall executable with an Extended Validation Code Signing Certificate
otherpoe - do not show "poe-out-current" on devices which can not determine it
otherpoe - hide PoE related properties on interfaces which does not provide power output
otherwinbox - made UDP local and remote TX size parameters optional in Bandwidth Test tool
otherwinbox - show dual SIM options only for RouterBOARDs which does have two SIM slots
otherwinbox - use proper graph name for HDD graphs
otherwireless - enable all chains by default on devices without external antennas after configuration reset
securityMAJOR CHANGES IN v6.40.9: ---------------------- !) security - fixed vulnerabilities CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159; ----------------------
fixcertificate - fixed "add-scep" template existence check when signing certificate
fixdefconf - fixed wAP LTE kit default configuration
otherethernet - improved large packet handling on ARM devices with wireless
otherethernet - removed obsolete slave flag from "/interface vlan" menu
fixfilesystem - fixed NAND memory going into read-only mode
fixhotspot - fixed user authentication when queue from old session is not removed yet
fixinterface - fixed interface configuration responsiveness
fixipsec - fixed policies becoming invalid if added after a disabled policy
otherldp - properly load LDP configuration
fixppp - fixed "hunged up" grammar to "hung up" within PPP log messages
othersfp - hide "sfp-wavelength" parameter for RJ45 transceivers
featuresnmp - added remote CAP count OID for CAPsMAN
featuresupout - added "partitions" section to supout file
fixtile - fixed Ethernet interfaces becoming unresponsive
fixtr069-client - fixed unresponsive tr069 service when blackhole route is present
fixuserman - fixed compatibility with PayPal TLS 1.2
otheruserman - improved unique username generation process when adding batch of users
featurewinbox - added missing "dscp" and "clamp-tcp-mss" settings to IPv6 tunnels
featurewinbox - allow to specify full URL in SCEP certificate signing process
otherwinbox - by default specify keepalive timeout value for tunnel type interfaces
otherwinbox - show firmware upgrade message at the bottom of "System/RouterBOARD" menu
otherwinbox - show "scep-url" for certificates
otherwinbox - show "sector-writes" on ARM devices that have such counters
otherwinbox - show "sector-writes" on devices that have such counters
otherwinbox - show "System/Health" only on boards that have health monitoring
featurewireless - added option to disable PMKID for WPA2
otherwireless - enable all chains by default on devices without external antennas after configuration reset
fixwireless - fixed packet processing after removing wireless interface from CAP settings
otherwireless - improved client "channel-width" detection
otherwireless - improved Nv2 PtMP performance
otherwireless - increased stability on hAP ac^2 and cAP ac with legacy data rates
otherwireless - updated "united-states" regulatory domain information
fixcertificate - fixed incorrect SCEP URL after an upgrade
fixhealth - fixed empty measurements on CRS328-24P-4S+RM
otherike2 - use "policy-template-group" parameter when picking proposal as initiator
fixipv6 - fixed IPv6 behaviour when bridge port leaves bridge
fixrouterboard - fixed "mode-button" support on hAP lite r2 devices
fixssh - fixed SSH service becoming unavailable
fixtraffic-flow - fixed IPv6 destination address value when IPFIX protocol is used
otherwinbox - show "Switch" menu on cAP ac devices
otherwireless - improved compatibility with BCM chipset devices
featureconsole - do not allow variables that start with digit to be referenced without "$" sign
fixled - fixed unused "link-act-led" LED trigger on RBLHG 2nD, RBLHG 2nD-XL and RBSXTsq 2nD
othernetinstall - sign Netinstall executable with an Extended Validation Code Signing Certificate
otherromon - make "secret" field sensitive in console
fixtr069-client - fixed TR069 service becoming unavailable when related service package is not installed
fixwinbox - fixed "/tool e-mail send" attachment behavior
fixwinbox - fixed maximal ID for Traffic Generator stream
otherwinbox - made UDP local and remote TX size parameter optional in Bandwidth Test tool
otherwinbox - removed "Enable" and "Disable" buttons from IPsec "mode-config" list
otherwinbox - show "D" flag under "/ip dhcp-client" menu
otherwinbox - use proper graph name for HDD graphs
otherwireless - enable all chains by default on devices without external antennas after configuration reset
fixbtest - fixed TCP test accuracy when low TX/RX rates are used
othercertificate - do not use UTF-8 for SCEP challenge password
fixcertificate - fixed PKCS#10 version
featurechr - generate new system ID on first boot
fixcrs317 - fixed reliability on FAN controller
fixdefconf - fixed DISC Lite5 LED default configuration
fixdhcpv4-server - fixed framed and classless route received from RADIUS server
fixdisk - fixed disk detach process
fixdude - fixed e-mail notifications when default port is not used
fixexport - fixed "/system routerboard mode-button" compact export
featurefilesystem - implemented additional system integrity checks on reboots
otherfirewall - limited maximum "address-list-timeout" value to “35w3d13h13m56s”
fixhotspot - fixed "dst-port" to require valid "protocol" in "walled-garden ip"
fixhotspot - fixed Walled Garden IP functionality when address-list is used
fixike1 - fixed crash on XAUTH if user does not exist
fixike1 - fixed memory corruption when IPv6 is used
otherike1 - improved stability on phase1 rekeying
featureike2 - added support for multiple split networks
otherike2 - delay rekeyed peer outbound SA installation
otherike2 - improve half-open connection handling
otherike2 - kill connection when peer changes address
otherike2 - use peer configuration address when available on empty TSi
fixipsec - fixed incorrect esp proposal key size usage
fixovpn - fixed resource leak on systems with high CPU usage
fixppp - fixed "change-mss" functionality when MSS is not set on forwarded packets
fixppp - fixed L2TP and PPTP encryption negotiation process on configuration changes
fixroute - fixed DHCP/PPP “add-default-route” “distance” minimal value to 1
fixsms - fixed minor problem for SMS delivery
featuresnmp - added IPv6 addresses support on default "public" community
fixsnmp - fixed bulk requests when non-repeaters are used
fixsnmp - fixed consecutive OID bulk get from the same table
fixtraceroute - fixed "/tool traceroute" results print
featurewebfig - added support for proper default policies when adding script or scheduler job
fixwebfig - fixed backup loading from Webfig on RouterBOARD running default configuration
fixwebfig - fixed bridge port sorting order by name
fixwebfig - fixed MAC address ordering
fixwebfig - fixed router getting reset to default configuration
fixwebfig - fixed column ordering
featurewinbox - allow to specify "to-ports" for "action=masquerade"
fixwireless - fixed wireless protocol mode restrictions if lockpack is installed and has limits for it
+17 more items in the release notesfixbonding - fixed 802.3ad mode on RB1100AHx4
fixconsole - fixed different command auto complete
fixcrs1xx/2xx - fixed 1 Gbps forced mode for several SFP modules
featurecrs317 - added L2MTU support
fixdhcp - fixed downgrade from RouterOS v6.41 or higher
fixdhcpv4-server - fixed lease renew for DHCP clients that sends renewal with "ciaddr = 0.0.0.0"
fixdhcpv6-client - fixed IA evaluation order
fixdiscovery - fixed timeouts for LLDP neighbours
fixethernet - fixed occasional broken interface order after reset/first boot
fixethernet - fixed rare linking problem with forced 10Mbps full-duplex mode
fixexport - fixed export for PoE-OUT related settings
fixexport - fixed wireless "ssid" and "supplicant-identity" compact export
fixfasttrack - fixed fasttrack over interfaces with dynamic MAC address
fixfirewall - fixed bridge "action=log" rules
fixfirewall - fixed crash on fasttrack dummy rule manual change attempt
fixike1 - fixed initiator ID comparison to NAT-OA
fixipv6 - fixed IPv6 address request from pool
fixmetarouter - fixed display of bogus error message on startup
featureovpn - added support for "push-continuation"
featureovpn - added support for topology subnet for IP mode
fixovpn - fixed duplicate default gateway presence when receiving extra routes
fixping - fixed ping getting stuck (after several thousands of ping attempts)
fixppp - fixed non-standart PAP or CHAP packet handling
fixpppoe-client - fixed incorrectly formed PADT packet
fixpppoe-client - fixed wrong MRU detection over VLAN interfaces
fixproxy - fixed rare program crash after closing client connection
fixquickset - fixed incorrect VPN address value on arm and tilera
fixrb1100ahx4 - fixed HW acceleration fragmented packet decryption when fragment is smaller than 64 bytes
fixrb1100ahx4 - fixed startup problems (requires additional reboot after upgrade)
fixrb2011 - fixed possible LCD blinking along with ethernet LED
fixrb3011 - fixed packet passthrough on switch2 while booting
fixsafe-mode - fixed session handling when Safe Mode is used on multiple sessions at the same time
fixsfp - fixed invalid temperature readings when ambient temperature is below 0C
fixsfp - fixed OPTON module DDM information readings
featurevlan - do not allow VLAN MTU to be higher than L2MTU
featurewebfig - allow to unset "rate-limit" for DHCP leases
featurewinbox - added possibility to define "comment" for "/routing bgp network" entries
featurewinbox - added support for certificate CRL list
featurewireless - added "etsi1" and "russia3" regulatory domain information
featurewireless - updated "china", "norway" and "new-zealand" regulatory domain information
+47 more items in the release notesfix6to4 - fixed wrong IPv6 "link-local" address generation
fixarp - fixed "make-static"
featurebonding - do not add bonding interface if "could not set MTU" error is received
fixconsole - fixed "/ip neighbor discovery" export
fixconsole - fixed unexpected console crash when using variables as functions
fixdefconf - fixed default configuration generation when wireless package is disabled
fixdefconf - fixed Groove 52 ac band settings
fixethernet - fixed "loop-protect" on "master-port"
fixethernet - fixed rare switch chip hang (could cause port flapping)
fixfetch - fixed download issue over HTTPS
featurefirewall - do not allow to set "rate" value to 0 for "limit" parameter
fixfirewall - fixed "address-list" entry "creation-time" adjustment to timezone
fixfirewall - fixed "address-list" entry changing from IP to DNS and vice versa
fixfirewall - fixed cosmetic "invalid" flag when item was disabled
fixike1 - fixed crash on xauth message
featureike2 - allow multiple child SA traffic selectors on re-key
fixike2 - fixed last EAP authentication payload type
fixike2 - fixed policy release during SA negotiation
fixike2 - fixed RSA authentication without EAP
fixike2 - fixed situation when traffic selector prefix was parsed incorrectly
fixipsec - fixed generated policy priority
fixipsec - fixed peer "my-id" address reset
breakingipv6 - fixed address becoming invalid when interface was removed from bridge/mesh
fixled - fixed turning off LED when interface is lost
featurelog - added missing "license limit exceeded" log entry
fixnetinstall - fixed typos in Netinstall status messages
fixppp - fixed IPv6 address receiving on PPP interface
featurepppoe - added warning on PPPoE client/server, if it is configured on slave interface
featuresnmp - added fan-speed OIDs in "/system health print oid"
featureuserman - allow "name-for-user" to be empty and not unique
featurewebfig - allow to enter frequency ranges in wireless “scan-list”
featurewebfig - allow to select "default-encryption" profile on PPP tunnels
featurewebfig - do not allow to reorder items if table is sorted by some column
featurewinbox - added "Flush" button under “unicast-fdb” menu
featurewinbox - added "memory-scroll", "filter-cpu", "filter-ipv6-address", "filter-operation-between-entries" Sniffer parameters
featurewinbox - added “protected-routerboard” parameters under RouterBOARD settings menu
featurewinbox - allow shorten bytes to k,M,G in firewall "connection-bytes" and "connection-rates"
featurewinbox - do not allow Packet Sniffer "memory-limit" and "file-limit" lower than 10KiB
featurewinbox - do not allow to open multiple same sub-menus at the same time
securitywinbox - hide "wps-mode" & "security-profile" in wireless nv2 mode
+35 more items in the release notessecurityFixes CVE-2017-20149: The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated user can trigger the vulnerability by s…
fixchr - fixed problem when transmit speed was reduced by interface queues
otherdhcp - do not listen on IPv4/IPv6 client to IPv6 MLD packets
otherdude - (changes discussed here: https://wiki.mikrotik.com/wiki/Manual:The_Dude_v6/dude_v6.xx_changelog)
otherexport - do not show "read-only" IRQ entries
featurefilesystem - implemented procedures to verify and restore internal file structure integrity upon upgrading
featurefirewall - do not allow to set "time" parameter to 0s for "limit" option
fixfirewall - fixed import of exported configuration that had updated "limit" setting
fixgraphing - fixed graphing crash when high amount of traffic is processed
fixhotspot - fixed rare kernel crash on multicore systems
fixhotspot - fixed redirect to URL where escape characters are used (requires newly generated HTML files)
otherhotspot - show Host table commentaries also in Active tab and vice versa
otherinterface - do not treat multiple zeros as single zero on name comparison
otherirq - properly detect all IRQ entries
fixl2tp-client - fixed IPSec policy generation after reboot
otherlcd - show fan2 speed only if it is available
fixleds - fixed defaults for RBSXT5HacD2nr2
othermmips - improved general stability
fixrb3011 - fixed noise from buzzer after silent boot
fixswitch - fixed crash when trying to configure second master port on the same chipset (RB3011, RB2011, CCR1009-8G-1S+)
featureuserman - allow access to User Manager users page only through "/user" URL
otheruserman - show warning when no users are selected for CSV file generation
featurewinbox - added "add-relay-info" and "relay-info-remote-id" to DHCP relay
featurewinbox - added H flag to "/ip arp"
featurewinbox - added missing "use-fan2" and "active-fan2" to "/system health"
featurewinbox - allow shorten bytes to k,M,G in bridge firewall just like in “/ip firewall”
otherwinbox - do not hide "power-cycle-after" option
otherwinbox - do not hide 00:00:00:00:00:00 MAC address in unpublished ARPs
fixwinbox - fixed matching "connection-state=untracked" connections
fixwinbox - fixed typo in “/system resources pci” list
otherwinbox - hide advertise tab in Hotspot user profile configuration if "transparent-proxy" is not enabled
otherwinbox - make "power-cycle-after" show correct value
otherwinbox - make "power-cycle-interval" not to depend on "power-cycle-ping-enabled" in PoE settings
otherwinbox - properly show BGP communities in routing filters table filter
fixwireless - fixed scan tool stuck in background
otherwireless - improved compatibility with Intel 2200BG wireless card
otherwireless - update Thailand country frequency settings
fixbonding - fixed "tx-drop" on VLAN over bonding on x86
featurecertificates - added year cap (invalid-after date will not exceed year 2039)
breakingcertificates - fixed crash when crl is removed while it is being fetched
fixcertificates - fixed fail on import from CAPs when both key and name already exist
featurecrs - added comment ability in more switch menus
fixdhcpv6-client - fixed DHCPv6 rebind on startup
fixdhcpv6-server - fixed server removal crash if static binding was present
fixdns - fixed typo in regexp error message
fixfirewall - fixed "time" option by recognizing weekday properly (introduced in v6.37.2)
fixfirewall - fixed dynamic raw rule behaviour
fixfirewall - fixed rule activation if "time" option is used and no other active rules are present
fixhotspot - fixed nat rule port setting in "hs-unauth-to" chain by changing it from "dst-port" to "src-port" on Walled Garden ip "return" rules
fixipsec - fixed kernel failure on tile with sha256 when hardware encryption is not being used
featureipv6 - added warning about having interface MTU less than minimal IPv6 packet fragment (1280)
fixled - fixed dark mode for cAP 2nD (http://wiki.mikrotik.com/wiki/Manual:System/LEDS#Leds_Setting)
fixlicense - fixed demo license expiration after installation on x86
fixmetarouter - fixed startup process (introduced in 6.37.2)
fixppp - fixed packet size calculation when MRRU is set (was 2 bytes bigger than MTU allows)
featureprofile - added "bfd" and "remote-access" processes
featureprofile - added ability to monitor cpu usage per core
fixproxy - fixed "max-cache-object-size" export
fixqueue - fixed "time" option by recognizing weekday properly (introduced in v6.37.2)
fixrb750Gr3 - fixed ipsec with 3des+md5 to work on this board
fixrb751u - fixed ethernet LEDs
fixsnmp - fixed rare crash when incorrectly formatted packet was received
fixssh - fixed high memory consumption when transferring file over ssh tunnel
fixswitch - fix BPDU dynamic Host table entry on Atheros Gigabit switch chips
fixtraceroute - fixed memory leak
fixtrafficgen - fixed compact export when "header-stack" includes tcp
featurevlan - allow to add multiple VLANs which name starts with same number and has same length
securitywebfig - added extra protection against XSS exploits
featurewinbox - added "Complete" flag to arp table
featurewinbox - added "make-static" to IPv6 DHCP server bindings
featurewinbox - added "prefix-pool" to DHCPv6 server binding
featurewinbox - added upstream flag to IGMP proxy interfaces
featurewinbox - allow to enable/disable traffic flow targets
featurewinbox - allow to specify "connection-bytes" & "connection-rate" for any protocol in “/ip firewall” rules
featurewinbox - allow to specify "sip-timeout" under ip firewall service-ports
featurewinbox - do not allow to set "loop-protect-send-interval" to 0s
securitywireless - show comment on "security-profile" if it is set
+34 more items in the release notesfixarp - fixed crash that caused Ethernet frames to go out via wrong interface
fixfastpath - fixed kernel crash on interface disable/remove
fixfetch - fixed bug with incomplete files in https mode
otheripsec - don't log authtype mismatch as critical
fixipsec - fixed xauth parameter printing in terminal
fixpppoe - fixed kernel crash caused by dial-on-demand when used with fastpath
fixpppoe - fixed master interface l2mtu check, could result in assumption that master interface can handle 14 byte bigger packet than it actually can (broken in 6.36)
fixsimple queues - fixed issue which caused additional/unnecessary CPU load
featurevlan - do not allow to add new vlan interface with mtu higher than l2mtu
fixtile - fixed rare kernel crash when usb device is being attached
otheraddress-list - make "dynamic=yes" as read-only option
fixbonding - fixed 802.3ad load balancing mode over tunnels
fixbonding - fixed bonding primary slave assignment for ovpn interfaces after startup
fixbonding - fixed crash on RoMON traffic transmit
fixdhcpv6 client - fixed ia lifetime validation when it is set by dhcpv6 client
featuredisk - added support for Plextor PX-G128M6e(A) SSD on CCR1072
fixethernet - fixed memory leak when setting interface without changing configuration
otherfirewall - do not show disabled=no in export
fixhealth - fixed broken factory voltage calibration data for some hAP ac boards
fixhealth - fixed incorrect voltage after reboot on RB2011UAS
fixipsec - fixed mode-config export
fixipsec - fixed route cache overflow when using ipsec with route cache disabled
otherlte - use only creg result codes as network status indications
otherovpn - enable perfect forwarding secrecy support by default
fixrb3011 - fixed port flapping on ether6-ether10
fixrb3011 - fixed reset button functionality
otherrb3011 - improved performance on high cpu usage
fixdiscovery - fixed identity discovery (introduced in 6.34.5)
fixlog - fixed time zone adjustment (introduced in 6.34.5)
fixsnmp - fixed snmp timeout (introduced in 6.34.5)
fixvrrp - fixed missing vrrp interfaces after upgrade (introduced in 6.34.5).
otherdude - (http://wiki.mikrotik.com/wiki/Manual:The_Dude_v6/dude_v6.xx_changelog)
otherdude - in order to connect to dude server user requires dude policy to be enabled
otherbonding - do not corrupt bonding statistics on configuration changes
fixbonding - fixed crash when vlan parent mtu is higher than bonding mtu
othercloud - do not write minor status changes to storage
featureethernet - do not allow mtu to be higher than l2mtu and l2mtu to be higher than max-l2mtu (reduce automatically on upgrade if it was wrong before)
otheripsec - better flush on proposal change
fixipsec - fixed crash on policy update
fixlog - fixed reboot log messages
featurelte - do not allow to set multiple modes when it is not supported
fixqueue - fixed interface queue type for ovpn tunnels
fixrb3011 - fixed port flapping on ether6-ether10
fixrb3011 - fixed time keeping
fixswitch - fixed compact export
fixtile - fixed performance regression on switch chip (introduced in 6.33rc18)
otherwinbox - show voltage in Health only if there actually is voltage monitor
fixwireless - fixed issue when CAPsMAN could lock CAPs interface