MikroTik RouterOS 6.42.12 → 7.25
56 releases · 3 breaking changes · 37 security fixes · 42 advisories fixed
37security3breaking1deprecated224feature334fix
Vulnerabilities fixed by this upgrade
- 8.2 CVE-2026-67277KEV RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra…
- 6.5 CVE-2026-67279KEV RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send…
- 9.8 CVE-2026-86060KEV RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to…
- 7.2 CVE-2025-6443 Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Aut…
- 7.5 CVE-2023-32154 Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik…
- 7.5 CVE-2023-30800 The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTT…
- 9.1 CVE-2023-30799 MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-a…
- 7.5 CVE-2020-20021 An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon.
- 6.4 CVE-2022-45315 Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authenticated attackers to execute arbitrary code via a crafted p…
- 8.8 CVE-2022-45313 Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message.
- 6.5 CVE-2022-36522 Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. This vulnerability allows attackers to cause a Denial of…
- 6.5 CVE-2021-36613 Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
- 6.5 CVE-2021-36614 Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process. An authenticated remote attacker can cause a Denial of Service (NULL pointer deref…
- 6.5 CVE-2020-20221 Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticated remote attacker can cause a Denial o…
- 6.5 CVE-2020-20262 Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /ram/pckg/security/nova/bin/ipsec process. An authenticated remote attacker can cause a Denial of…
- 6.5 CVE-2020-20249 Mikrotik RouterOs before stable 6.47 suffers from a memory corruption vulnerability in the resolver process. By sending a crafted packet, an authenticated remote attacker can cause a Denial of Serv…
- 6.5 CVE-2020-20230 Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. An authenticated remote attacker can cause a Denial of Service due to overloading the sys…
- 6.5 CVE-2020-20252 Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL po…
- 6.5 CVE-2020-20250 Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL po…
- 6.5 CVE-2020-20217 Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process. An authenticated remote attacker can cause a Denial of Se…
- 6.5 CVE-2020-20225 Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process. An authenticated remote attacker can cause a Denial of Service due to an a…
- 6.5 CVE-2020-20264 Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. An authenticated remote attacker can cause a Denial of Service due to a divide by zero error.
- 6.5 CVE-2020-20266 Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. An authenticated remote attacker can cause a Denial of Service (NULL point…
- 6.5 CVE-2020-20220 Mikrotik RouterOs prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/bfd process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dere…
- 6.5 CVE-2020-20253 Mikrotik RouterOs before 6.47 (stable tree) suffers from a divison by zero vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service due to a di…
- 6.5 CVE-2020-20254 Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. An authenticated remote attacker can cause a Denial of Service (NULL poi…
- 6.5 CVE-2020-20265 Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /ram/pckg/wireless/nova/bin/wireless process. An authenticated remote attacker can cause a Denial o…
- 6.5 CVE-2020-20267 Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/resolver process. An authenticated remote attacker can cause a Denial of Service due to i…
- 6.5 CVE-2020-20247 Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute process. An authenticated remote attacker can cause a Denial of Service due…
- 7.5 CVE-2019-16160 An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.
- 7.5 CVE-2020-11881 An array index error in MikroTik RouterOS 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5, allows an unauthenticated remote attacker to crash the SMB server via modified setup-request packets, aka…
- 7.5 CVE-2020-10364 The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write sys…
- 3.7 CVE-2019-3981 MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover the user's username and MD5 hashed pass…
- 8.8 CVE-2019-3976 RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs…
- 7.5 CVE-2019-3977 RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can tr…
- 7.5 CVE-2019-3978 RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the att…
- 7.5 CVE-2019-3979 RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router adds all A records to its DNS cache even when the records are unrelated to the…
- 6.5 CVE-2019-15055 MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to…
- 6.5 CVE-2019-13954 Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server and in som…
- 6.5 CVE-2019-13955 Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server via recursi…
- 7.5 CVE-2019-13074 A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of uncontrolled resource mana…
- 8.1 CVE-2019-3943 MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or Win…
Breaking changes
- breaking dhcpv4-server - fixed removal of dynamic leases when server is removed in 7.5
- breaking vrrp - improved connection tracking synchronization protocol (CTSYNC), the new protocol is incompatible with previous RouterOS versions with "sync-connection-tracking=yes" in 7.5
- breaking wifiwave2 - fixed WPA3-PSK authentication incompatibility with certain vendor and model devices in 7.3.1
Security changes
- security system - improve stability (includes CVE-2026-84411) in 7.23.8
- security crypto - improve stability (CVE-2026-67278) in 7.23.6
- security user - improve failed login delay logic (CVE-2026-16347) in 7.23.6
- security Fixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to… in 7.23.4
- security Fixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra… in 7.23.4
- security Fixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send… in 7.23.4
- security Fixes CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig… in 7.23.4
- security Fixes CVE-2026-67281: RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.… in 7.23.4
- security wifiwave2 - improve protections from denial-of-service attacks on WPA3 in 7.8
- security Fixes CVE-2022-45315: Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authenticated attackers to execute arbitrary code via a crafted p… in 7.6
- security firewall - fixed IRC NAT helper (CVE-2022-2663) in 7.6
- security Fixes CVE-2022-45313: Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message. in 7.5
- security system - improve stability (includes CVE-2026-84411) in 6.49.23
- security system - improve stability (includes CVE-2026-67281) in 6.49.22
- security Fixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to… in 6.49.21
- security Fixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra… in 6.49.21
- security Fixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send… in 6.49.21
- security security - allow only "http:" and "https:" schemas in relevant dst fields in 6.49.19
- security Fixes CVE-2024-54772: An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18.… in 6.49.18
- security Fixes CVE-2023-30800: The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTT… in 6.49.10
- security !) ipv6 - fixed DNS server processing by IPv6/ND services (CVE-2023-32154) in 6.49.8
- security firewall - fixed IRC NAT helper (CVE-2022-2663) in 6.49.8
- security !) ipv6 - fixed DNS server processing by IPv6/ND services (CVE-2023-32154) in 6.48.7
- security firewall - fixed IRC NAT helper (CVE-2022-2663) in 6.48.7
- security MAJOR CHANGES IN v6.47.10: ---------------------- !) wireless - fixed all affecting 'FragAttacks' vulnerabilities (CVE-2020-24587, CVE-2020-24588, CVE-2020-26144, CVE-2020-26146, CVE-2020-26147); ---------------------- in 6.47.10
- security hotspot - fixed special character parsing in "target" variable (CVE-2021-3014) in 6.47.9
- security smb - fixed possible memory leak (CVE-2020-11881) in 6.46.7
- security wireless - fixed potential wireless driver issue related to CVE-2020-3702 in 6.46.7
- security winbox - made "none" the default value for "Security Profile" parameter when creating a new "Wirelees->Connect list" entry in 6.45.9
- security security - fixed vulnerability for routers with default password (limited to Wireless Wire), admin could login on startup with empty password before default configuration script was fully loaded in 6.45.8
- security Fixes CVE-2020-20221: Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticated remote attacker can cause a Denial o… in 6.44.6
- security MAJOR CHANGES IN v6.44.6: ---------------------- !) package - accept only packages with original filenames (CVE-2019-3976); !) package - improved package signature verification (CVE-2019-3977); !) security - fixed improper handling of DNS responses (CVE-2019-3978, CVE-2019-3979);… in 6.44.6
- security system - accept only valid string for "name" parameter in "disk" menu (CVE-2019-15055) in 6.44.6
- security MAJOR CHANGES IN v6.44.5: ---------------------- !) security - fixed vulnerabilities CVE-2019-13954, CVE-2019-13955; !) security - fixed vulnerabilities CVE-2019-11477, CVE-2019-11478, CVE-2019-11479; !) security - fixed vulnerability CVE-2019-13074; ---------------------- in 6.44.5
- security conntrack - fixed GRE protocol packet connection-state matching (CVE-2014-8160) in 6.44.5
- security ovpn - added "verify-server-certificate" parameter for OVPN client (CVE-2018-10066) in 6.44.5
- security www - improved client-initiated renegotiation within the SSL and TLS protocols (CVE-2011-1473) in 6.44.5
Deprecations
- deprecated route - removed deprecated "/routing/route/rule" menu in 7.21.5
Every release in between
fixbridge - disable DHCP snooping ip binding table (introduced in v7.24)
otherbridge - enable vlan hardware offloading on hAP be3 Media device
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.24.3)
fixconsole - fix scheduler scripts with the default start date and time not being triggered (introduced in v7.24)
otherethernet - improve stability on hAP be3 Media device
otherlte - improve stability for MBIM modem mode switch
fixospf - fix unset interface template parameters not being applied to interfaces
fixpoe-out - fix loss of PoE-out capability on CRS328-24P-4S+ after a reboot
othersystem - improve stability
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.24.3)
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.23.6)
otherethernet - improved stability when forcing unsupported link speed
fixipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder
fixospf - fix unset interface template parameters not being applied to interfaces
fixquickset - fix the WAN interface being selected incorrectly
securitysystem - improve stability (includes CVE-2026-84411)
othersystem - stop the flash configuration store from growing on dynamic configuration changes
fixwifi - fix malformed management frame information elements advertising availability of multiple 6GHz APs
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.23.6)
otherbgp - improve stability
featurecertificate - add "SSL.com Root Certification Authority ECC" to built-in root certificate authorities store
featurecertificate - allow importing a cross-signed certificate without replacing the existing one
othercertificate - refactor certificate internal processes
othercertificate - remove "GoDaddy Class 2 CA" from built-in root certificate authorities store
otherconsole - improve stability
securitycrypto - improve stability (CVE-2026-67278)
fixipsec - fix duplicate connections on IKEv2 retransmissions
otheripsec - improve stability
fixleds - fix LEDs set to interface status staying off when the interface is active
otherppp - improve stability
featureptp - add manual configuration of PTP message intervals and per-port enabling and disabling
fixptp - fix PTP offset instability under heavy background multicast traffic
fixptp - fix PTP timestamps showing the wrong time on CRS510
othersfp - improve QSFP-DD breakout link establishing to NVIDIA DGX Spark and other devices
othersystem - improve stability
securityuser - improve failed login delay logic (CVE-2026-16347)
otherwifi - update radio regulatory information
otherwww - improve stability
fixdhcp - fixed IPv6 DHCP functionality (introduced in v7.23.4)
securityFixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to…
securityFixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra…
securityFixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send…
securityFixes CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig…
securityFixes CVE-2026-67281: RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.…
fixbgp - fix BGP link-local nexthops unreachable over a VRF and a crash when disabling an unnumbered connection
otherbtest - improve stability
fixcertificate - fix changing the built-in trust store setting (introduced in 7.22.2)
otherconsole - improve stability
otherdhcp - improve stability of DHCP handling
otherdisk - improve stability of the SMB server
otherfetch - improve stability of the TFTP client
fixipsec - fixed expired SA handling to prevent "no such item" errors during listing
otheripsec - improve IKE handshake stability
otherleds - improved interface stats activity for devices with Marvell Prestera switch chip
otherlte - removed extra restart after firmware upgrade for EC200A-EU modem
fixlte - fix the RG650E-EU modem not bringing link up after a firmware update
featureping - add parameter checks for arp ping
othersnmp - properly validate password length when applying configuration
otherssh - refactor SSH internal processes and improved system stability
othersystem - improve handling of invalid SSL/TLS requests
othersystem - improve stability
fixtunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22)
otherwebfig - improve stability
otherwifi - updated radio regulatory information
fixwinbox - fix the "addresses" spelling in read-only fields
fixwireguard - fixed peer Tx/Rx counters
otherwireguard - generate port number when specified as zero
otherwireguard - reinitialize socket on VRF change
otherwww - improve stability
fixconsole - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal
fixethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22)
fixvrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip
fixbfd - fixed delay on session print
fixbgp - fixed advertisement print handling by "dst" when destination is in VRF
fixbgp - fixed IPv6 End-of-Route processing
otherbgp - improved stability on MP (multiprotocol) parsing
fixbridge - fixed dynamic VLAN update for wifi interfaces
fixbridge - fixed stability issue when using DHCPv4 snooping
othercloud - cloud backup file management now requires "policy" policy
fixconsole - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal
fixcontainer - fixed missing config.json issue when upgrading from version 7.20.8 or older
featuredisk - avoid reading SCSI stats all the time to allow disks to go to sleep
fixethernet - fixed stability issue with TSO on Alpine CPUs
otherethernet - improved system stability on devices with Alpine CPUs
otheripv6 - do not disable IPv6 FastPath when Traffic Flow is enabled
featureisis - allow to configure metric-type
fixisis - fixed missing "l2.lsp-refresh-interval" parameter
otherl3hw - improved system stability on device shutdown/reboot
fixlte - fixed cases where EC25-EU and EG25-G boards would receive packets with missing last 4 bytes
fixlte - fixed crash on LTE passthrough interface deactivation
fixospf - fixed interface passive flag update in WinBox
fixroute - fixed static route flag handling by WinBox on disable
deprecatedroute - removed deprecated "/routing/route/rule" menu
fixswitch - fixed issue with MAC table for RB2011 (introduced in v7.21)
fixswitch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs
otherswitch - increase "ingress-rate" and "egress-rate" maximum value to 400G
othertimezone - updated timezone information from "tzdata2026b" release
otherupgrade - prevent package scheduling from interfering with the upgrade feature
fixvxlan - fixed fast-path when using "checksum=no" (introduced in v7.20)
featurewinbox - do not pre-fill "Allowed Address" and "Client Allowed Address" with "::/0" when adding new WireGuard Peer
fixbgp - fixed stability issue when non-existent output select-chain was specified
featurebgp-vpn - allow modifying scopes with routing filters
fixbgp-vpn - fixed non-working import filter after reboot
otherbgp-vpn - use target scope for imported route
fixbridge - fixed missing dynamic "switch-cpu" VLAN entry in WiFi setup
fixbridge - fixed performance regression in complex setups with vlan-filtering (introduced in v7.20)
otherconsole - removed the "reset" command from shared settings menus (IP/IPv6/Bridge/L3HW/Neighbor-Discovery/Connection-Tracking)
fixcontainer - fixed issue where the container might not start after upgrading if root-dir was not set
othercontainer - improved error message if a container fails to start
fixdefconf - fixed L009 configuration (introduced in v7.21)
fixethernet - fixed false excessive broadcast warning (introduced in v7.20)
otherfirewall - improved system stability
otheripsec - improved aes256-ctr stability on L009
otheripsec - removed modp8192 proposal on MIPS architectures
otheripv6,ra - use received prefix when RA on-link flag is 0
otherisis - improved stability with fragmented CSNP
otherl2tp - improved system stability on TILE architecture
fixl3hw - fixed missing VLAN counters after reboot (introduced in v7.21)
fixl3hw - fixed stability issue (introduced in v7.21)
fixleds - fixed default LED configuration for CCR2004-1G-12S+2XS
otherlog - do not provide non-existent logging topics for configuration
fixlte - fixed framed route support for the first APN
fixlte - fixed missing automatic redial when cellular connectivity is lost for R11e-LTE
fixlte - fixed user set MTU not applied to LTE interface
fixospf - fixed typos in log messages
fixovpn - fixed OVPN push routes
fixpoe-out - fixed rare PoE-Out firmware upgrade failure on CRS354-48P-4S+2Q+
featureptp - allow manual domain configuration for 802.1AS profile
fixqos-hw - fixed "offline" tx-manager ability to queue at least one packet (introduced in v7.21)
featureroute - added SLAAC route redistribution for IPv6 capable routing protocols
fixrouterboard - fixed applying settings via WinBox on devices with fixed CPU frequency
featurerouting-filter - added possibility to match SLAAC and bgp-mpls-vpn route types
fixswitch - fixed stability issue when changing bridge multicast-router property on CRS1xx/2xx (introduced in v7.19)
featuresystem - added FCC Part 15 Compliance label to "System/Regulatory" menu
fixuser - properly apply login delay (introduced in v7.20)
fixwifi-mediatek - fixed communication issues on 802.11ax access points with Intel clients
fixwifi-mediatek - fixed HE capabilities IE on 2GHz band
fixwinbox - fixed "Remote AS" setting under the "Routing/BGP/Connections" menu
fixwinbox - fixed "Src/Dst Address Type" under the "IP/Firewall/NAT" menu
fixwinbox - fixed L3HW default value for VLAN interface (introduced in v7.21)
+16 more items in the release notesfixbgp - fixed route refresh subcode 0 warning
featurebgp - implement revised input error handling per RFC 7606
fixbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20.7)
fixcontainer - fixed nftables/iptables not working with "Message too long" error
fixhealth - fixed fan and PSU state logging for MIPSBE devices
otherpoe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces)
fixpoe-out - fixed PSU state recovery upon unplug/replug on CRS320
featureppp - added initial support for BG770A-GL modem firmware update
otherroute - prevent creating routing tables with the same name
fixrouting-filter - fixed num-set matcher
fixsfp - fixed sfp-ignore-rx-loss parameter for RB760iGS
fixsnmp - fixed handling of the script "dont-require-permissions" parameter when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput
fixsnmp - fixed permission error reporting when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput (introduced in v7.20.7)
fixsnmp - fixed script "run-count" update after execution
fixsystem - fixed rare partial loss of RouterOS configuration
otheruser-manager - properly release database backup file after backup creation
fixw60g - fixed possible memory leak when an interface is disabled
otherzerotier - improved route removal
fixbgp - fixed l2vpn-cisco decoding (introduced in v7.20)
fixbgp - fixed occasional corruption of MPLS labels in BGP VPN update messages
fixbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20)
fixbridge - improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20)
otherbth - make user private-key sensitive
fixconsole - fixed empty output in route menus when using "print where gateway"
otherconsole - updated copyright notice
otherfirewall - clear relevant masqueraded connection tracking entries on IP address change
otheripv6 - initialize RA receiving when enabled and without any other IPv6 configuration
fixlog - fixed memory leak
fixlte - fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20)
fixlte - fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17
fixovpn - fixed OVPN server handling on reboot (introduced in v7.20)
otherovpn - improved system stability when using cipher=blowfish128
fixsfp - fixed "sfp-tx-fault" state indication for CRS520-4XS-16XQ
fixsfp - fixed missing link up/down notifies
fixswitch - fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches
othersystem - detect policy mismatch sooner if script is executed internally by some other service
fixups - fixed board hibernation shutdown
featurewifi-mediatek - added Superchannel regulatory profile
otherbridge - improved system stability with IGMP snooping
otherethernet - improved performance for hEX Refresh and hEX S (2025)
otherike2 - improved system stability
fixleds - fixed signal strength LEDs for Cube 60G ac
featurelog - added VRF support for remote logging
featurelog - establish a new connection to the remote log server when action settings are edited (e.g. after changing the src-address property)
fixlog - fixed memory leak when a connection to remote TCP log server failed
fixlog - fixed unsent message retransmit to correct endpoints (introduced in v7.18)
otherlog - randomize source port when using remote logging with src-address specified
fixlte - fixed wrong subnet mask set to Chateau 5G R17 ax LTE interface
fixmac-server - fixed interface-list change behavior
featurepoe-out - added "poe-in" detection for 802.3at poe-out capable ports
otherpoe-out - firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces)
fixpoe-out - fixed "low-voltage" LLDP deny for RB5009 and RB960 in specific voltage/power-source combinations
fixpoe-out - fixed missing error status report in rare cases for 802.3at
fixrouterboot - fixed load of other kernels (e.g. OpenWrt) on NAND-less boards with MT762x, IPQ40xx, QCA955x and QCA953x CPUs ("/system routerboard upgrade" required)
fixsfp - fixed the I2C clock frequency for the hEX S (2025) to prevent EEPROM read issues with GPON modules
fixswitch - fixed switch name for CRS418
fixswitch - improved system stability after switch reset while bonding interfaces are active (introduced in v7.18)
featuretraffic-flow - added support for IPv6 packet sampling
fixtraffic-flow - fixed flow reports when using IPv6 and packet sampling (introduced in v7.18)
fixw60g - fixed disconnect issue (introduced in v7.19.4)
featurewinbox - allow selecting bonding interface under "Switch/Rule" menu
otherwinbox - use "auto" as default value for VXLAN "Don't Fragment" property
fixconsole - fixed issue with file-name completion (introduced in v7.18)
fixcontainer - fixed repository name handling to prevent redirect issues when basic authentication is used
fixlte - additional fixes for eSIM management support
otherlte - AT modems, improved redialing when modem lost connectivity without notifying host about APN status change
fixnetinstall - fixed socket reset (introduced in v7.18)
fixqueue - fixed system failure when CAKE kind queue was configured but queue type definition does not exist anymore (introduced in v7.18)
otherwifi - improved stability for wifi interfaces
otherwinbox - improve graphing efficiency when communicating with WinBox
fixdevice-mode - do not allow changing CPU frequency if "routerboard" is not allowed by device mode (introduced in v7.17)
fixdevice-mode - fixed feature and mode update via power-reset on PPC devices
fixdisk - fixed showing free space on tmpfs (introduced in v7.17)
fixdisk - improved system stability when SMB interface list is used (introduced in v7.17)
otherdns - do not show warning messages for DNS static entries when they are not needed
fixhotspot - fixed an issue where extra "flash/" is added to html-directory for devices with flash folders (introduced in v7.17)
othersfp - improved system stability with some GPON modules for CCR2004 and CCR2116 devices
fixsmb - fixed connection issues with clients using older SMB versions (introduced in v7.17)
fixswitch - fixed dynamic switch rules created by dot1x server (introduced in v7.17)
fixsystem - fixed a potential memory leak that occurred when resetting states after an error
othercertificate - do not download CRL if there is not enough free RAM
fixcertificate - fixed handling of capsman-cap certificates (introduced in v7.16)
featuredhcpv4-server/relay - added additional error messages for DHCP servers and relays
fixdns - fixed lookup order for static DNS entries (introduced in v7.16.1)
otherethernet - improved linking after reboot for hAP ax lite devices ("/system routerboard upgrade" required)
othergps - changed default GPS antenna setting for LtAP mini with internal LTE/GPS combo antenna
fixleds - fixed bogus argument for "leds" property (introduced in v7.16)
fixleds - fixed PoE-in LEDs for CRS318-1Fi-15Fr-2S device
othermodem - KNOT BG77 modem, improved handling of modem unexpected restarts
fixroute - fixed possible issue with inactive routes after reboot (introduced in v7.16)
otherrouterboot - improved stability for IPQ8072 and IPQ6010 when flash-boot is used ("/system routerboard upgrade" required)
fixlte - fixed possible crash when enabling/disabling config-less modem interface
fixlte - fixed R11e-LTE no traffic flow when modem with older firmware version is used
otherrouterboard - improved Etherboot stability for CRS320-8P-8B-4S+ device ("/system routerboard upgrade" required)
fixssh - fixed unsupported user SSH public key import (introduced in v7.15)
otherbgp - correctly synchronize input.accept-nlri address list
otherbridge - use default "edge=auto" for dynamically bridged interfaces (PPP, VPLS, WDS)
otherdisk - improved system stability
fixfetch - fixed slow throughput due to "raw" logging which occurred even when not listening to the topic (introduced in v7.13)
fixqueue - improved system stability (introduced in v7.6)
featurewifi-qcom - added configuration.distance setting to enable operation over multi-kilometer distances (CLI only)
fixbridge - fixed MLAG connection after peer-link flap (introduced in v7.13)
fixbridge - fixed packet forwarding after changing HW offloaded bridge interface settings in certain cases (introduced in v7.13)
fixdns - do not close connection with DoH server after query execution (introduced in v7.13.3)
fixleds - fixed modem signal strength for RBSXTR&R11e-LTE (introduced in v7.13)
othersms - increased SMS read timeout
otherwifi-qcom - improved memory allocating process
otherwifi-qcom - improved regulatory compliance for L11, L22 devices
otherwifi-qcom - improved system stability for L11, L22 devices
other(factory only release)
other(factory only release)
fixwifiwave2 - fixed interface hangs on IPQ6010-based boards (introduced in v7.9)
otherrouterboard - improved RouterBOOT stability for Alpine CPUs ("/system routerboard upgrade" required)
othersfp - improved SFP interface handling for RB4011 device
fixbgp - fixed setting of "default-prepend" parameter
fixbridge - fixed adding disabled MSTI
fixbridge - fixed DHCP packet flow when using DHCP snooping, HW offloading and "use-ip-firewall"
fixbridge - fixed possible DHCP packet corruption when using DHCP snooping
fixbridge - fixed PVID warning typo
fixcertificate - fixed export of a certificate when the last line of the certificate is exactly 64 bytes long
fixcertificate - fixed PBES2 certificate import
featureconsole - added "as-string" parameter to the ":execute" command
featurecontainer - added authentication option for registry (CLI only)
fixcontainer - fixed ".type" file ownership
fixcontainer - fixed file ownership after system upgrade for containers running on internal disk
featuredns - added configurable DoH concurrent query limitation parameters
featureike2 - added support for "address", "key-id" and "dn" for Remote ID matching (CLI only)
featureipsec - added support for "Framed-Route" RADIUS attribute support
featureipv6 - added "pref64" option configuration for RA
featurel3hw - added destination MAC address check for offloaded FastTrack connections
featurelte - added AT support for Telit LE910C4 in MBIM mode
featureovpn - added AES-GCM and multicore encryption support
featurepoe - added LLDP power management support for 802.3at PSE
featuresniffer - added additional filtering parameters
featuretorch - allow "without-paging" parameter for Torch
featurevxlan - added "dont-fragment" setting that allows managing fragmentation
featurevxlan - added "max-fdb-size" parameter
featurevxlan - added FastPath support
featurewebfig - allow setting numeric values in time interval fields
featurewifiwave2 - added wireless sniffer tool to capture wireless transmissions (CLI only)
featurewifiwave2 - implement 802.11w management protection SA Query procedures
securitywifiwave2 - improve protections from denial-of-service attacks on WPA3
featurewinbox - added "Connect" button under "WifiWave2/Scan" menu
featurewinbox - added "Disable/Enable" buttons under "WifiWave2" menu
featurewinbox - added "Match Subdomain" parameter under "IP/DNS/Static" menu
featurewinbox - added "Provision" button under "WifiWave2" menu
featurewinbox - added "Start On Boot" checkbox under "Container" menu
featurewinbox - added "Tx Rate" and "Rx Rate" columns under "WifiWave2/Registration" menu
featurewinbox - added missing properties when setting "Use DoH Server"
featurewinbox - added missing WifiWave2 related parameters under "WifiWave2" menu
featurewinbox - added support for manual RAM file system (TMPFS) creation under "System/Disk" menu
featurewinbox - added Type "https-get" parameter under "Tools/Netwatch" menu
featurewinbox - allow selecting bridge for static entries under "Bridge/MDB" menu
featurex86 - added support for TP-Link TG-3468
+101 more items in the release notesfeaturebgp - added comment functionality for BGP VPN (CLI only)
featurebluetooth - added unique advertise message filtering
featurebridge - added support for static MDB entries
featurediscovery - added "discovered-by" parameter to indicate which protocol discovered the neighbor
featurediscovery - added "mode" parameter for discovery configuration
featuredisk - added support for manual RAM file system (TMPFS) creation (CLI only)
featurefirewall - added "set-priority" option for IPv6 mangle firewall
featurehotspot - added "install-hotspot-queue" parameter to control dynamic queue creation
featureike2 - added support for ChaChaPoly1305 encryption
featureike2 - added support for DH Group 31 (EC25519) (CLI only)
featureinterface - do not allow adding invalid "veth" interfaces
featureipsec - added "current-address" parameter for peers with DNS address
featureipsec - added hardware acceleration support for IPQ-6010
featureipsec - added support for AVX optimized SHA acceleration
featurel2tp - added VRF support for L2TP Ether interfaces
featurelte - added AT channel support for Telit FN990
featurelte - added CA information in 5G mode
featuremodem - added USB tethering support for Google Pixel 7 devices
featurempls - added VPLS LDP information in remote/local-mappings
featurenetinstall - added "-i " parameter for Netinstall (CLI Linux)
featurenetwatch - added support for "https-get" type (CLI only)
featureovpn - added "CBC" postfix to AES cipher names
featureovpn - added "route-nopull" option for client side
featureovpn - added hardware acceleration support for IPQ-6010
featureovpn - added support for IPv6 tunneling
featureport - added serial port support for Telit FN990 modem
featuresfp - added 2.5G SFP module support for RB5009
featuresfp - allow usage of "10G Base-LR" mode for XS+31LC10D module
featuresnmp - added support for "lldpRemLocalPortNum" OID's
featuressh - added support for Ed25519 key exchange
featuressh - do not allow SHA1 usage with strong crypto enabled
featuresupout - added MSTI and mst-override monitor for bridge MSTP
featuresupout - added missing IPv6 firewall sections
featuresystem - allow up to 4GB of RAM allocation per process on x86, ARM64 and TILE
featuretunnels - added VRF support for EoIP, IPIP and GRE tunnels
featurevxlan - added "local-address" parameter support
featurevxlan - added VRF support
featurewifiwave2 - added "datapath" settings to configure data forwarding for an interface (CLI only)
featurewifiwave2 - added "ft-preserve-vlanid" parameter to control whether to change VLAN ID after FT
featurewifiwave2 - added "provisioning" menu to automatically assign interface configurations to radios (CLI only)
+171 more items in the release notessecurityFixes CVE-2022-45315: Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authenticated attackers to execute arbitrary code via a crafted p…
featurebgp - added support for BGP advertisement displaying (CLI only)
featurecontainer - added "start-on-boot" parameter for automatic container startup
featurecontainer - allow changing container related parameters while it is running
featuredns - added "match-subdomain" option for static entries (CLI only)
featureethernet - added "5Gbps" option for speed setting
featurefirewall - added "src/dst-address-type" parameter under "IPv6/Firewall/Mangle" menu
securityfirewall - fixed IRC NAT helper (CVE-2022-2663)
featureinterface - added warning when interface has configured "mtu" higher than "l2mtu"
featureipsec - added "invalid-packets" counter for Installed SA's menu
featurel3hw - added "l3hw-settings" sub menu under the switch menu
featurel3hw - added support for IPv6 route offloading (disabled by default)
featurelte - added interface name in MTU debug logging message
featurelte - added periodic IPv6 RS to trigger IPv6 adress acquisition for non-MBIM modems
featurelte - added support for Neoway N75-EA
featurelte - added support to perform FOTA upgrade from local file for EG12-EA, EG18-EA, RG502Q-AE, EG06-A, EP06-A modems
featuremacsec - added configuration support with VLAN, ARP, DHCP and bridge tagging/untagging
featuremacsec - added logging support with "debug" and "dot1x" topics
featuremacsec - added support for MTU and L2MTU
featureospf - added SHA hashing for authentication
featureovpn - added IPv6 support
featureovpn - added VRF support for client
featureqsfp - added interface temperature warnings and shutdown
featureserial - added support for newer PL2303 serial controllers
featuresms - added "status-report-request" parameter for "send" command
featuresstp - added VRF support for client
featuresupout - added tr069-client section
featuretr069-client - do not allow ":" symbols in username
featureuser-manager - added "comment" parameter for batch user creation
featureuser-manager - added support for multiple accounting sessions
featureuser-manager - added variables to print profile name and end time in voucher templates
featureuser-manager - allow specifying router's address as subnet
featurevxlan - added IPv6 support for remote VTEPs (only IPv4 or IPv6 will be used at the same time, use "vteps-ip-version" property on VXLAN interface to change the version)
featurewinbox - added "Active" prefix for current remote and local session ID fields for L2TP-Ether interfaces
featurewinbox - added "address-list" parameter under "IP/DNS/Static" menu
featurewinbox - added "File Name" option for "Load Config" parameter under "System/SwOS" menu
featurewinbox - added icon for TR069-client menu
featurewinbox - added MACsec support
featurewinbox - added quick filtering option for route list
featurewinbox - added "Rapid Commit" parameter support under "IPv6/DHCP-Server" menu
+118 more items in the release notessecurityFixes CVE-2022-45313: Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message.
fixbgp - fixed remote refuse capability options, max prefix limit errors and administrative stop
fixbridge - fixed "new-priority" value validation for NAT rules
featurecapsman - added randomized range option for "reselect-interval" parameter (CLI only)
fixcertificate - fixed handling of empty AKID by SCEP client
fixconsole - fixed automatic command completion with keypress
featurecontainer - added support for running Docker (TM) containers on ARM, ARM64 and x86 (containers created before v7.4 must be recreated)
fixdefconf - fixed loading of default configuration on RB4011 with WifiWave2 package enabled
breakingdhcpv4-server - fixed removal of dynamic leases when server is removed
fixdhcpv6-relay - fixed relay forwarding (introduced in v7.1.5)
featuredns - added "address-list" parameter for static DNS entries (CLI only)
featuredns - added "match-subdomain" option for static entries (CLI only)
featurefirewall - added support for RTSP helper
fixhealth - fixed "temperature" and "power-consumption" readings on RB1100x4
fixhostpot - fixed Walled Garden functionality for HTTPS sites
featureike2 - allow sending certificate chain as initiator
fixinterface - fixed default interface naming on RB1100x2
fixl3hw - fixed HW offloaded NAT
fixleds - fixed default LED configuration for RBwsAP-5Hac2nD
fixleds - fixed wireless LED functionality on LHGG
featurelte - added at-chat and NMEA port support for Simcom modems, USB composition (device id - 0x9003)
featurelte - added at-chat support for Simcom modems, USB composition (device id - 0x9005)
featurelte - added "SIM not inserted" and "SIM failure" messages to "status" and "monitor" commands for AT modems
fixlte - fixed AT channel for Sierra Wireless modems with device ID 0x9091
fixlte - fixed LTE interface presence for Telit LN940
fixlte - fixed UDP performance on MMIPS devices
fixnetinstall - fixed Netinstall procedure for ARM devices
fixntp - fixed NTP server when "use-local-clock" is used
fixospf - fixed handling of external forwarding address
featureport - added support for D-Link DWM-222 in serial/PPP mode (device id - 0xac01/0x7e3d)
featureport - added support for Huawei/ZTE K5006z in serial/PPP mode (device id - 0x1017/0x1018)
featurerouterboard - added "reset-button" script feature for TILE devices
featuressh - added AES support for PEM decryption
featureswos - enabled SwitchOS support for CRS310-1G-5S-4S+
featuretraceroute - added "do-not-fragment" parameter support (CLI only)
featurevrrp - added "sync-connection-tracking" compatibility with preemption-mode
breakingvrrp - improved connection tracking synchronization protocol (CTSYNC), the new protocol is incompatible with previous RouterOS versions with "sync-connection-tracking=yes"
featurewebfig - allow to specify NTP server as domain name
featurewifiwave2 - added "sae-pwe" parameter with hash-to-element mechanism for SAE PWE derivation
featurewifiwave2 - added support for 802.11k
+66 more items in the release notesfixfirewall - fixed "in-interface-list" matcher when VRF is used
othernetwatch - changed ICMP default packet loss fail threshold to 85%
fixnetwatch - fixed usage of "timeout" value in simple mode
fixsfp - fixed speed mode setting after reinserting SFP module on CRS328-4C-20S-4S+
othersfp - improved combo SFP ports initialization handling on CRS312-4C+8XG, CRS328-4C-20S-4S+
fixwinbox - fixed "Type" and "Value" field displaying under "System/Health" sub-menu's
fixrb3011 - fixed RB3011 going into a reboot loop when the SFP module is present (introduced in v7.3)
breakingwifiwave2 - fixed WPA3-PSK authentication incompatibility with certain vendor and model devices
fixsystem - fixed RouterOS bootup when wifiwave2 package is installed (introduced in v7.2.2)
fixroute - fixed "table" menu emptying after RouterOS upgrade
securitysystem - improve stability (includes CVE-2026-84411)
securitysystem - improve stability (includes CVE-2026-67281)
securityFixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to…
securityFixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra…
securityFixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send…
otherbtest - improve stability
otherconsole - improve stability
otherfetch - improve stability of the TFTP client
othersnmp - improve stability of SNMP
otherssh - refactor SSH internal processes and improved system stability
othersystem - improve stability
othersystem - updated certificate for Windows executable signing
othertimezone - updated timezone information from "tzdata2026b" release
otherconsole - updated copyright notice
otherethernet - improved system stability for RB912, RB911 devices
fixmac-server - fixed configuration change for "interface-list" property
otherrouterboard - do not show "upgrade-firmware" if available installation is older than minimal supported one
otherconsole - updated copyright notice
featurelte - added support for R11e-LTE6 v039 firmware release
securitysecurity - allow only "http:" and "https:" schemas in relevant dst fields
fixsystem - fixed v6 to v7 upgrade from separate packages
othersystem - improved upgrade procedure reliability
otherupgrade - the upgrade, testing, and development channels now direct to the latest long-term version of RouterOS v7
securityFixes CVE-2024-54772: An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18.…
otherconsole - updated copyright notice
otherfetch - improved system stability when using TFTP
otherhotspot - properly escape all reserved URI characters
featureradius - added "require-message-auth" option that requires "Message-Authenticator" in received Access-Accept/Challenge/Reject messages
otherradius - include "Message-Authenticator" in any RADIUS communication messages besides accounting for all services
featuresystem - added "shutdown" parameter for reset-configuration (CLI only)
fixsystem - fixed false log message about successful package installation
fixsystem - fixed v6 to v7 upgrade from separate packages
othersystem - improved system stability
othersystem - set flash-boot mode as "boot-device" after system reset initiated by reset button ("/system routerboard upgrade" required)
othersystem - set flash-boot mode as "boot-device" after system reset initiated from software
otheruser - improved authentication procedure when RADIUS is not used
featurewireless - allow to set Canada2 country profile when locked with US lock package for CubeG device
fixwireless - fixed antenna gain for SXT5ac device
fixdefconf - fixed firewall rule for IPv6 UDP traceroute
securityFixes CVE-2023-30800: The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTT…
otherwww - improved service stability when receiving malformed packets
security!) ipv6 - fixed DNS server processing by IPv6/ND services (CVE-2023-32154)
otherconsole - updated copyright notice
fixdefconf - fixed invalid default password setting after configuration reset for 60GHz interface (introduced in v6.49.5)
securityfirewall - fixed IRC NAT helper (CVE-2022-2663)
otherhotspot - improved stability when receiving bogus packets
fixsmb - fixed SMB2 file list reporting
security!) ipv6 - fixed DNS server processing by IPv6/ND services (CVE-2023-32154)
othercapsman - improved stability when running background scan on CAP
otherconsole - updated copyright notice
securityfirewall - fixed IRC NAT helper (CVE-2022-2663)
otherhotspot - improved stability when receiving bogus packets
fixsmb - fixed SMB2 file list reporting
fixsnmp - fixed IPsec-SA byte and packet counter reporting
othercertificate - improved stability when sending bogus SCEP message
otherquickset - use 5GHz interface's country for "Home AP Dual" configuration
othersystem - improved system stability if device is upgraded from RouterOS and/or RouterBOOT v6.41.4 or older
featureupgrade - added new "upgrade" channel for upgrades between major versions
featurewinbox - do not allow to add/remove W60G interfaces
featurewireless - added U-NII-2 support for US and Canada country profiles for cAP ac XL and QRT 5 ac
featurebranding - properly clean up old branding files before installing a new one
fixcrs3xx - fixed default MAC address calculation on management Ethernet for CRS312, CRS326-24S+2Q+ and CRS354 devices
othergps - improved interface monitoring
otherhealth - improved temperature reporting
otherike2 - check if TS is still valid after obtaining SPI
otheripsec - improved SA update by SPI
othernetinstall - require Netinstall version to be the same or newer as "factory-software"
otherpoe - update PoE firmware only on devices that supports it
otherppp - improved stability when receiving bogus response on modem channel
otherqsfp - improved system stability when setting unsupported link rates
featuresfp - added "sfp-rate-select" setting (CLI only)
othersfp - improved SFP, SFP+, SFP28 and QSFP+ interface stability for CRS3xx and CCR2004 devices
othersfp28 - changed FEC auto mode to disabled
otherw60g - limit power output when using region EU to match EN302567 on nRAY
otherw60g - use EU region by default
featurewinbox - added "name" and "file-name" parameter when importing and exporting certificates
featurewinbox - allow setting MCS (24-31) to 4x4 Wireless interfaces
featurewinbox - do not allow to set empty "init-string" field under "System/GPS" menu
otherwinbox - do not show "GPS antenna" selection for devices without selection support
otherwinbox - show "System/Health/Settings" only on boards that have configurable values
otherwinbox - show "current-channel" column by default for CAP interfaces
featurewireless - added U-NII-2 support for US and Canada country profiles for hAP ac lite
securityMAJOR CHANGES IN v6.47.10: ---------------------- !) wireless - fixed all affecting 'FragAttacks' vulnerabilities (CVE-2020-24587, CVE-2020-24588, CVE-2020-26144, CVE-2020-26146, CVE-2020-26147); ----------------------
otherbonding - improved system stability when disabling/enabling bonding ports
featurebranding - added option to upload custom files (newly generated branding package required)
othercapsman - use proper units for "ap-tx-limit" and "client-tx-limit" parameters
otherconsole - do not clear environment values if any global variable is set
otherconsole - require "write+ftp" permissions for exporting configuration to file
otherconsole - updated copyright notice
featurecrs3xx - added "/system swos" menu for CRS354 devices, should only be used after SwOS 2.13 release
fixcrs3xx - fixed interface LEDs for QSFP+ and SFP+ interfaces on CRS317, CRS309, CRS312, CRS326-24S+2Q+ and CRS354 devices
othercrs3xx - improved 1Gbps Ethernet port group traffic forwarding for CRS354 devices
othercrs3xx - improved system stability when receiving large frames on CPU for CRS317, CRS309, CRS312, CRS326-24S+2Q+ and CRS354 devices
fixdefconf - fixed default configuration loading on LHG R
fixdefconf - fixed default configuration loading on RBOmniTikPG-5HacD
fixdhcp - fixed link state checking for DHCP client
fixdude - fixed configuration menu presence on ARM64 devices
otherethernet - improved system stability when receiving large VLAN tagged packets on IPQ4018/IPQ4019 devices
fixipsec - fixed SA address parameter exporting
fixlte - fixed "earfcn" to band translation for "cell-monitor"
fixovpn - fixed route cache entry leak when establishing a new session
otherpoe - do not perform PoE firmware upgrade procedure on RB960 and OmniTik devices without PoE out
otherppp - do not fail "at-chat" command when issued on disabled PPP interface
otherptp - improved management service stability when receiving bogus packets
otherquickset - prefer 5GHz interface for WiFi scan in CPE mode
fixrb4011 - fixed SFP+ port MTU setting after link state change
otherrb4011 - improved SFP+ port stability after boot-up
otherroute - improved stability when connected route is modified
othersfp - improved cable length monitoring as defined per SFF-8472 and SFF-8636
fixsupout - fixed "topic" column presence in "Log" section
otherswitch - improved system stability with 98PX1012 switch chip for CCR2004-1G-12S+2XS device
othersystem - improved resource allocation (improves several service stability e.g. HTTPS, PPPoE, VPN)
othertelnet - do not send options if connecting to non standard port
fixtelnet - fixed server when run on non standard port
fixtile - fixed bridge performance degradation (introduced in v6.47)
featurewebfig - allow to specify "prefix" parameter under "IPv6/ND/Prefixes" menu
fixwinbox - fixed "reachable-time" value unit under "IPv6/ND" menu
fixwinbox - fixed QCA-8511 switch chip type reporting under "Switch/Settings" menu
fixwinbox - fixed health reporting on RB960, hEX and hEX S devices
featurewinbox - hide "Allow Roaming" parameter on LTE modems that do not support it
fixwireless - fixed issue with multicast traffic delivery to client devices using power-save
featurewww - added "X-Frame-Options" header information to disallow website embedding in other pages
+12 more items in the release notesfixbgp - fixed VPNV4 RD byte order
fixbranding - fixed LCD logo loading from new style branding package
fixcrs312 - fixed missing SwOS firmware on revision 2 devices
othercrs3xx - correctly filter packets by L2MTU size
fixcrs3xx - improved system stability when receiving large frames for CRS317, CRS309, CRS312, CRS326-24S+2Q+ and CRS354 devices (introduced in v6.47.5)
fixdefconf - fixed default configuration loading on RBcAP-2nD and RBwAP-2nD
fixhotspot - fixed "idle-timeout" usage with RADIUS authentication
securityhotspot - fixed special character parsing in "target" variable (CVE-2021-3014)
otherpackage - do not include multiple The Dude packages in HDD installer
fixsnmp - fixed "send-trap" functionality
fixwebfig - fixed new interface addition
fixwinbox - fixed enable/disable button presence for "Bridge/Hosts" menu
otherwinbox - renamed IP protocol 41 to "ipv6-encap"
otherwinbox - show "System/Health" only on boards that have health monitoring
otherwinbox - use health values reported by gauges for "System/Health" menu
otherwireless - renamed "macedonia" regulatory domain information to "north macedonia"
otherwireless - updated "indonesia5" regulatory domain information
fixcap - fixed L2MTU path discovery
fixchr - fixed file system quiescing
fixcrs3xx - fixed IGMP snooping for CRS312, CRS326-24S+2Q+ and CRS354 devices
fixcrs3xx - fixed switch rules for CRS309 and CRS317 devices (introduced in v6.46.7)
othercrs3xx - improved system stability on CRS354 devices
fixdefconf - fixed default configuration loading on RBmAP-2nD
otherdefconf - improved default configuration generation on devices with changed wireless interface names
otherdhcpv6-server - improved stability when changing server for static bindings
otherdhcpv6-server - properly save bindings when executing "make-static" command
fixfetch - fixed "src-address" usage for SFTP
otherfetch - improved SSL handshake processing
otherhotspot - do not verify Hotspot interface status when detecting if HTTP/HTTPS login method is allowed
fixleds - fixed LED type setting
fixlte - fixed multiple APN passthrough on R11e-4G
otherlte - limit allowed APN count to 3 on R11e-LTE
fixmpls - fixed duplicate "LabelRelease" message sending
otherospf - optimized LSA printing for smaller message sizes
fixpoe - fixed automatic PoE firmware upgrade procedure
otherpoe - improved PoE-out status detection
featureppp - allow specifying pool name for "remote-ipv6-prefix-pool" parameter
featureradius - added "Service-Type" attribute to Access-Request for IPv4 and IPv6 DHCP servers
othersmips - reduced RouterOS main package size
fixsms - fixed SMS sending when both "interface" and "smsc" parameters are specified
fixsnmp - fixed "/tool snmp-get" functionality (introduced in v 6.46beta43)
fixswitch - fixed Ethernet padding for small packets
otheruser - improved WinBox and The Dude authenticated session handling
otheruser-manager - updated PayPal's root certificate authorities
othervrrp - made "password" parameter sensitive
otherw60g - general stability and performance improvements
featurewireless - added support for US FCC UNII-2 and Canada country profiles for NetMetal series devices
fixwireless - fixed incorrect wireless capability information in association response frames
otherwireless - updated "kazakhstan" regulatory domain information
fixbridge - fixed host table update on SNMP query
fixbridge - fixed STP alternate and backup port states for devices with switch chip
fixcrs3xx - fixed hardware offloaded MPLS forwarding when using bonding interfaces
fixcrs3xx - fixed QSFP+ interface LEDs when using break-out cable for CRS326-24S+2Q+
fixcrs3xx - fixed switch ACL rules for CRS312, CRS326-24S+2Q+ and CRS354 devices
fixcrs3xx - fixed switch port "egress-rate" removal for CRS305, CRS326-24G-2S+, CRS328, CRS318 devices
fixdefconf - fixed default configuration loading on RBmAPL-2nD
fixdot1x - fixed duplicate EAP request packets for server
fixdot1x - fixed EAP packet version numbering
featureemail - added support for multiple "to" recipients
fixexport - fixed HotSpot "address-per-mac" parameter export
fixftp - fixed possible buffer overflow
fixike2 - fixed local side NAT detection
fixike2 - fixed policy reference for pending acquire
featureinterface - added new builtin "static" interface list
fixkidcontrol - fixed "time-unlimited-rate" to engage in correct time
fixlte - fixed modem initialization when multiple modems are used simultaneously
fixlte - fixed PDP authentication configuration for SIM7600
fixmetarouter - fixed image importing (introduced in v6.46)
fixospf - fixed disappearing NSSA default route
fixospf - fixed processing of "unknown" LSA type
fixpoe - fixed "power-cycle" functionality on hEX PoE, PowerBox Pro and OmniTIK 5 PoE ac
featureprofile - added support for CCR2004-1G-12S+2XS
fixqsfp - fixed auto-negotiation status
fixquickset - fixed invalid configuration applying when performing changes during LTE modem initialization process
fixrouterboard - fixed "reset-button" menu presence on all devices
fixrouterboot - fixed etherboot FCS errors with 100Mbps rate for CRS305, CRS309 and CRS317 devices ("/system routerboard upgrade" required)
fixsmb - fixed file path validation (introduced in v6.46)
securitysmb - fixed possible memory leak (CVE-2020-11881)
featuresniffer - allow setting port for "streaming-server"
featuresnmp - added "dot1qTpFdbTable" OID reporting for Q-BRIDGE-MIB
featurew60g - added "mdmg-fix" parameter for RBwAP60Gx3 (CLI only)
featurewinbox - added "region" parameter for W60G interfaces
featurewinbox - allow to specify any Ethernet like interface under "Tool/WoL" menu
featurewinbox - do not allow to enter empty strings in "caps-man-names" and "common-name" parameters
featurewireless - added support for U-NII-2 for cAP ac
featurewireless - added support for U-NII-2 for wAP ac
featurewireless - allow setting "tx-power" up to 40
securitywireless - fixed potential wireless driver issue related to CVE-2020-3702
featurewww - added "tls-version" parameter in "IP->Services" menu
+37 more items in the release notesotherarm - improved watchdog and kernel panic reporting in log after reboots on RB3011 and IPQ4018/IPQ4019 devices ("/system routerboard upgrade" required)
fixcapsman - fixed "certificate" parameter updating on CAP
fixcertificate - fixed certificate verification when flushing CRL's
featurechr - added support for file system quiescing
featurechr - enabled support for VMBus protocol version 4.1
otherchr - improved system stability when running CHR on Hyper-V
otherconsole - prevent incorrect type interfaces appearing in command hints
fixcrs3xx - fixed frame forwarding after disabling/enabling bridge hardware offloading for CRS354-48G-4S+2Q+ device
fixcrs3xx - fixed interface statistics for CRS354-48G-4S+2Q+ and CRS354-48P-4S+2Q+ devices
fixcrs3xx - fixed switch rule "dst-port" parameter for IPv6 traffic on CRS305-1G-4S+, CRS326-24G-2S+, CRS328-24P-4S+, CRS328-4C-20S-4S+, netPower 15FR devices
featuredefconf - added welcome note with common first steps for new users
fixhealth - fixed maximum SFP temperature reading under '/system health' menu
fixhotspot - fixed redirect to log in page (introduced in v6.45)
featureled - added "dark-mode" functionality for CRS105-5S-FB
featurelte - added "phy-cellid" value support for LTE-US
fixlte - fixed IP type selection from APN on RBSXTLTE3-7
fixsniffer - fixed minor typo in "host" menu
fixsnmp - fixed "ifSpeed" reporting for tunnel interfaces
fixsnmp - fixed "routeros-version" value returning from registration table
fixsnmp - fixed UPS battery voltage value scaling
featuressh - added support for RSA keys with SHA256 hash (RFC8332)
fixsystem - improved system stability when forwarding traffic from switch chip to CPU (introduced in v6.43)
featurewebfig - added default configuration confirmation window to WebFig
featurewebfig - allow skin designing without "ftp" and "sensitive" policies
featurewinbox - added "Options" parameter support for DHCPv6 client and server
featurewinbox - added 160Mhz extension channel support for CAPsMAN
featurewinbox - added support for "Tools->WoL" menu
fixwinbox - fixed "ARP" parameter inheritance from "CAPs Configuration" configuration
fixwinbox - fixed "Bands" parameter display for LTE interfaces
fixwinbox - fixed "DSCP" parameter value setting
fixwinbox - fixed "Frequency" and "Secondary Frequency" parameter inheritance from "CAPs Channel" configuration
fixwinbox - fixed "Passthr. MAC Address" parameter display "LTE APNs" menu
fixwinbox - fixed "Switch" menu on CRS354-48P-4S+2Q+
fixwinbox - fixed "dst-port" unsetting in "IP->Hotspot->Walled Garden" menu
fixwinbox - fixed "invalid" flag presence under "System/Certificates/CRL" menu
fixwinbox - fixed automatic "IPv6->Firewall->Address List" table update
securitywinbox - made "none" the default value for "Security Profile" parameter when creating a new "Wirelees->Connect list" entry
featurewireless - added "skip-dfs-channels" parameter
featurewireless - allow using FCC "U-NII-2" frequency range for hAP ac2 and RBwAPGR series devices
fixwireless - fixed default "antenna-gain" setting on SXT 2 devices
+20 more items in the release notesfixcapsman - fixed background scan showing incorrect regulatory domain mismatch error (CAP upgrade required)
othercapsman - improved radar detection algorithm
otherchr - improved stability when changing ARP modes on e1000 type adapters
fixconsole - fixed "clear-history" restoring historic actions after power cycle
otherconsole - removed "edit" and "set" actions from "System/History" menu
otherconsole - updated copyright notice
othercrs305 - disable optical SFP/SFP+ module Tx power after disabling SFP+ interface
otherdhcpv4-server - improved stability when RADIUS interim update is sent
fixdhcpv6-client - fixed timeout when doing rebind
otherdhcpv6-client - properly update bind time when unused prefix received from the server
otherdhcpv6-client - properly update IPv6 address on rebind
fixdhcpv6-server - fixed logged error message when using "address-pool=static-only"
otherdhcpv6-server - ignore prefix-hint from client's DHCPDISCOVER if static prefix received from RADIUS
fixhealth - fixed health reporting on OmniTIK 5 PoE ac
otheripsec - improved system stability when processing decrypted packet on unregistered interface
otherl2tp - improved system stability when disconnecting many clients at once
fixled - fixed default LED configuration for RBLHG-2nD and RBLHG-5HPnD
otherlte - show SIM error when no card is present
fixppp - fixed connection establishment when receiving "0.0.0.0" DNS
fixppp - fixed minor typo in "ppp-client" monitor
otherppp - prioritize "remote-ipv6-prefix-pool" from PPP secret over PPP profile
otherqsfp - do not report bogus monitoring readouts on modules without DDMI support
otherqsfp - improved module monitoring readouts for DAC and break-out cables
featurerouterboard - added "mode-button" support for RBcAP2nD
securitysecurity - fixed vulnerability for routers with default password (limited to Wireless Wire), admin could login on startup with empty password before default configuration script was fully loaded
fixssh - fixed output printing when "command" parameter used
othertimezone - updated time zone database to version 2019c
othertraffic-generator - improved memory handling on CHR
fixw60g - fixed "monitor" command on disabled interfaces
featurewinbox - automatically refresh "Packets" table when new packets are captured by "Tools/Packet Sniffer"
otherwinbox - show "LCD" menu only on boards that have LCD screen
featurewireless - added "ETSI" regulatory domain information
featurewireless - added "indonesia4" regulatory domain information
featurewireless - added U-NII-2 support forRBSXTsqG-5acD, RBLHGG-5acD-XL, RBLHGG-5acD, RBLDFG-5acD, RBDiscG-5acD
featurewireless - allow using "canada2" regulatory domain on US lock devices
fixwireless - fixed sensor MAC address reporting in TZSP header
otherwireless - improved compatibility by adding default installation mode and antenna gain for devices with integrated antennas
otherwireless - improved compatibility for Switzerland wireless country profile to improve compliance with ETSI regulations
otherwireless - improved IPQ4019, QCA9984, QCA9888 wireless interface stability
securityFixes CVE-2020-20221: Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process. An authenticated remote attacker can cause a Denial o…
securityMAJOR CHANGES IN v6.44.6: ---------------------- !) package - accept only packages with original filenames (CVE-2019-3976); !) package - improved package signature verification (CVE-2019-3977); !) security - fixed improper handling of DNS responses (CVE-2019-3978, CVE-2019-3979);…
fixcapsman - fixed frequency setting requiring multiple frequencies
fixcapsman - fixed newline character missing on some logging messages
otherccr - improved packet processing after overloading interface
fixcrs312 - fixed combo SFP port toggling (introduced in v6.44.5)
othercrs328 - adjust fan speed based on SFP and CPU temperature
othercrs3xx - correctly display link rate when 10/100/1000BASE-T SFP modules are used in SFP+ interfaces
fixcrs3xx - fixed management access when using switch rule "new-vlan-priority" property
fixexport - fixed "bootp-support" parameter export
otherhealth - improved fan control on CRS3xx and CCR1016-12S-1S+r2
fixike2 - fixed policy port selection for responder with natted initiator
fixike2 - fixed traffic selector address family selection when using IPv6
fixinterface - fixed missing PWR-LINE section on PL7411-2nD and PL6411-2nD (introduced v6.44)
featureipsec - allow inline "passphrase" parameter when importing keys
fixipsec - fixed minor spelling mistakes in logs
fixled - fixed default LED configuration for RBLHG5nD
fixospf - fixed opaque LSA type checking in OSPFv2
fixospf - fixed possible busy loop condition when accessing OSPF LSAs
otherospf - improved "unknown" LSA handling in OSPFv3
featureprofile - added "internet-detect" process classificator
fixradius - fixed open socket leak when invalid packet is received (introduced in v6.44)
fixsfp - fixed "sfp-rx-power" value for some transceivers
othersmb - improved stability on x86 and CHR
fixsnmp - fixed encrypted data sequence (introduced in v6.44.5)
othersnmp - improved reliability on SNMP service packet validation
otherssh - accept remote forwarding requests with empty hostnames
fixssh - fixed carriage return presence in subsequent sessions
fixssh - improved remote forwarding handling (introduced in v6.44.3)
fixsupout - fixed supout file generation outside of internal storage with insufficient space
fixswitch - fix port isolation for non-CRS series switch chips
securitysystem - accept only valid string for "name" parameter in "disk" menu (CVE-2019-15055)
othersystem - improved system stability for devices with AR9342 SoC
fixupgrade - fixed "auto-upgrade" to use new style authentication
fixupnp - fixed XML parsing (FG-VD-19-110)
otherwatchdog - renamed "no-ping-delay" parameter to "ping-start-after-boot"
featurewinbox - added "auto-erase" parameter to "Tools/SMS" menu
featurewinbox - added "https-redirect" parameter to "IP/Hotspot/Profiles menu"
featurewinbox - added "revision" parameter to "System/Routerboard" menu
otherwinbox - removed "max-sms" parameter from "Tools/SMS" menu
+4 more items in the release notessecurityMAJOR CHANGES IN v6.44.5: ---------------------- !) security - fixed vulnerabilities CVE-2019-13954, CVE-2019-13955; !) security - fixed vulnerabilities CVE-2019-11477, CVE-2019-11478, CVE-2019-11479; !) security - fixed vulnerability CVE-2019-13074; ----------------------
otherbridge - correctly handle bridge host table
fixcapsman - fixed CAP system upgrading process for MMIPS
fixcapsman - fixed interface-list usage in access list
othercertificate - removed "set-ca-passphrase" parameter
othercloud - properly stop "time-zone-autodetect" after disable
securityconntrack - fixed GRE protocol packet connection-state matching (CVE-2014-8160)
otherdefconf - automatically set "installation" parameter for outdoor devices
fixdhcpv6-client - fixed status update when leaving "bound" state
fixdhcpv6-server - fixed dynamic IPv6 binding without proper reference to the server
otherdhcpv6-server - override prefix pool and/or DNS server settings by values received from RADIUS
fixdiscovery - fixed CDP packets not including address on slave ports (introduced in v6.44)
othere-mail - properly release e-mail sending session if the server's domain name can not be resolved
fixfirewall - fixed fragmented packet processing when only RAW firewall is configured
otherfirewall - process packets by firewall when accepted by RAW with disabled connection tracking
othergps - strip unnecessary trailing characters from "longtitude" and "latitude" values
otherhotspot - moved "title" HTML tag after "meta" tags
otheripv6 - improved system stability when receiving bogus packets
securityovpn - added "verify-server-certificate" parameter for OVPN client (CVE-2018-10066)
otherrb3011 - improved system stability when receiving bogus packets
otherrb921 - improved system stability ("/system routerboard upgrade" required)
othersnmp - improved reliability on SNMP service packet validation
fixssh - fixed non-interactive multiple command execution
featuresupout - added IPv6 ND section to supout file
featuresupout - added "pwr-line" section to supout file
othersupout - changed IPv6 pool section to output detailed print
featurewinbox - do not allow setting "dns-lookup-interval" to "0"
otherwireless - improved DFS radar detection when using non-ETSI regulated country
otherwireless - improved installation mode selection for wireless outdoor equipment
otherwireless - updated "china" regulatory domain information
securitywww - improved client-initiated renegotiation within the SSL and TLS protocols (CVE-2011-1473)
fixw60g - fixed memory leak (introduced in v6.43.15)
fixdhcpv4-server - fixed commenting option for alerts
fixdhcpv6-server - fixed binding setting update from RADIUS
otherike1 - improved stability for transport mode policies on initiator side
otheripv6 - adjusted IPv6 route cache max size
otheripv6 - adjust IPv6 route cache max size based on total RAM memory
otheripv6 - improved IPv6 neighbor table updating process
otherlte - reset LTE modem only when SIM slot is changed on dual SIM slot devices
otherlte - use default APN name "internet" when not provided
otherrb2011 - removed "sfp-led" from "System/LEDs" menu
fixrb4011 - fixed SFP+ interface full duplex and speed parameter behaviour
otherrb4011 - improved SFP+ interface linking to 1Gbps
fixsmb - fixed possible buffer overflow
featuresnmp - added "radio-name" (mtxrWlRtabRadioName) OID support
otherssh - do not generate host key on configuration export
fixswitch - fixed possible crash when interface state changes and DHCP Snooping is enabled
othersystem - accept only valid path for "log-file" parameter in "port" menu
otheruserman - updated authorize.net gateway DNS name
otherwebfig - improved file handling
otherwinbox - improved file handling
otherwinbox - show "R" flag under "IPv6/DHCP Server/Bindings" tab
featurewireless - added support for US FCC UNII-2 and Canada country profiles for LHG-5HPnD-US, RBLHG-5HPnD-XL-US and SXTsq5HPnD-US devices
otherwireless - improved wireless country settings for EU countries, outdoor models will use outdoor frequency range by default
otherwireless - improved system stability for all devices with 802.11ac wireless
otherwireless - improved wireless country settings for EU countries
otheripv6 - adjust IPv6 route cache max size based on total RAM memory
otherbridge - count routed FastPath packets between bridge ports under FastPath bridge statistics
fixbridge - fixed BOOTP packet forwarding when DHCP Snooping is enabled
fixbridge - fixed packet forwarding with enabled DHCP Snooping and Option 82
fixbridge - fixed possible memory leak when using "ingress-filtering=yes" on bridge interface
fixbridge - fixed system's identity change when DHCP Snooping is enabled (introduced in v6.43)
othercapsman - always accept connections from loopback address
othercertificate - force 3DES encryption for P12 certificate export
fixdhcp - fixed dual stack queue addition
featuredhcpv6-server - allow to add DHCPv6 server with pool that does not exist
fixdhcpv6-server - fixed missing gateway for binding's network if RADIUS authentication was used
featureethernet - added "tx-rx-1024-max" counter to Ethernet stats
fixethernet - fixed packet forwarding when SFP interface is disabled on hEX S
otherfetch - improved file downloading to slow memory
othergps - increase precision for dd format
othergps - removed unnecessary leading "0" for dd format
fixipsec - fixed all policies not getting installed after startup (introduced in v6.43.8)
fixipsec - fixed stability issues after changing peer configuration (introduced in v6.43)
featureipv6 - do not allow setting "preferred-lifetime" longer than "valid-lifetime"
featurekidcontrol - added "tur-fri", "tur-mon", "tur-sat", "tur-sun", "tur-thu", "tur-tue", "tur-wed" parameters
fixkidcontrol - fixed validation checks for time intervals
fixled - fixed default LED configuration for RBSXTsq-60ad
fixlldp - fixed missing capabilities fields on some devices
otherlte - do not show "session-uptime" if session is not up
otherlte - improved SIM7600 initialization after reset
fixntp-client - fixed "dst-active" and "gmt-offset" being updated after synchronization with server
fixppp - fixed dynamic route creation towards VPN server when "add-default-route" is used
fixrb4011 - fixed ether10 failing to auto negotiate link speed to 1Gbps
featuresmb - added commenting option for SMB users (CLI only)
fixsmb - fixed macOS clients not showing share contents
fixsmb - fixed Windows 10 clients not able to establish connection to share
fixsupout - fixed "poe-out" output not showing all interfaces
fixsupout - fixed Profile output on single core devices
featurewinbox - added "conflict-detection" parameter in "IP/DHCP Server" menu
featurewinbox - added "coordinate-format" parameter in LTE interface settings
featurewinbox - added "use-local-address" parameter in "IP/Cloud" menu
featurewinbox - allow specifying interface lists in "CAPsMAN/Access List" menu
fixwinbox - fixed "IPv6/Firewall" "Connection limit" parameter not allowing complete IPv6 prefix lengths
fixwinbox - fixed "LCD" menu not shown on RB2011UiAS-2HnD
fixwireless - fixed antenna gain setting on RBSXT5nDr2
featurewireless - improved connection stability for new model Apple devices
+6 more items in the release notes