MikroTik RouterOS 7.10.2 → 7.25
22 releases · 0 breaking changes · 8 security fixes · 8 advisories fixed
8security0breaking1deprecated22feature133fix
Vulnerabilities fixed by this upgrade
- 8.2 CVE-2026-67277KEV RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra…
- 9.1 CVE-2026-67278 MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store include…
- 6.5 CVE-2026-67279KEV RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send…
- 9.8 CVE-2026-86060KEV RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to…
- 8.1 CVE-2026-67276 RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig…
- 7.2 CVE-2025-6443 Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Aut…
- 5.4 CVE-2024-54772 An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18.…
- 5.3 CVE-2023-41570 MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.
Breaking changes
None in the release notes.
Security changes
- security system - improve stability (includes CVE-2026-84411) in 7.23.8
- security crypto - improve stability (CVE-2026-67278) in 7.23.6
- security user - improve failed login delay logic (CVE-2026-16347) in 7.23.6
- security Fixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to… in 7.23.4
- security Fixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra… in 7.23.4
- security Fixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send… in 7.23.4
- security Fixes CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig… in 7.23.4
- security Fixes CVE-2026-67281: RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.… in 7.23.4
Deprecations
- deprecated route - removed deprecated "/routing/route/rule" menu in 7.21.5
Every release in between
fixbridge - disable DHCP snooping ip binding table (introduced in v7.24)
otherbridge - enable vlan hardware offloading on hAP be3 Media device
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.24.3)
fixconsole - fix scheduler scripts with the default start date and time not being triggered (introduced in v7.24)
otherethernet - improve stability on hAP be3 Media device
otherlte - improve stability for MBIM modem mode switch
fixospf - fix unset interface template parameters not being applied to interfaces
fixpoe-out - fix loss of PoE-out capability on CRS328-24P-4S+ after a reboot
othersystem - improve stability
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.24.3)
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.23.6)
otherethernet - improved stability when forcing unsupported link speed
fixipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder
fixospf - fix unset interface template parameters not being applied to interfaces
fixquickset - fix the WAN interface being selected incorrectly
securitysystem - improve stability (includes CVE-2026-84411)
othersystem - stop the flash configuration store from growing on dynamic configuration changes
fixwifi - fix malformed management frame information elements advertising availability of multiple 6GHz APs
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.23.6)
otherbgp - improve stability
featurecertificate - add "SSL.com Root Certification Authority ECC" to built-in root certificate authorities store
featurecertificate - allow importing a cross-signed certificate without replacing the existing one
othercertificate - refactor certificate internal processes
othercertificate - remove "GoDaddy Class 2 CA" from built-in root certificate authorities store
otherconsole - improve stability
securitycrypto - improve stability (CVE-2026-67278)
fixipsec - fix duplicate connections on IKEv2 retransmissions
otheripsec - improve stability
fixleds - fix LEDs set to interface status staying off when the interface is active
otherppp - improve stability
featureptp - add manual configuration of PTP message intervals and per-port enabling and disabling
fixptp - fix PTP offset instability under heavy background multicast traffic
fixptp - fix PTP timestamps showing the wrong time on CRS510
othersfp - improve QSFP-DD breakout link establishing to NVIDIA DGX Spark and other devices
othersystem - improve stability
securityuser - improve failed login delay logic (CVE-2026-16347)
otherwifi - update radio regulatory information
otherwww - improve stability
fixdhcp - fixed IPv6 DHCP functionality (introduced in v7.23.4)
securityFixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to…
securityFixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra…
securityFixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send…
securityFixes CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig…
securityFixes CVE-2026-67281: RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.…
fixbgp - fix BGP link-local nexthops unreachable over a VRF and a crash when disabling an unnumbered connection
otherbtest - improve stability
fixcertificate - fix changing the built-in trust store setting (introduced in 7.22.2)
otherconsole - improve stability
otherdhcp - improve stability of DHCP handling
otherdisk - improve stability of the SMB server
otherfetch - improve stability of the TFTP client
fixipsec - fixed expired SA handling to prevent "no such item" errors during listing
otheripsec - improve IKE handshake stability
otherleds - improved interface stats activity for devices with Marvell Prestera switch chip
otherlte - removed extra restart after firmware upgrade for EC200A-EU modem
fixlte - fix the RG650E-EU modem not bringing link up after a firmware update
featureping - add parameter checks for arp ping
othersnmp - properly validate password length when applying configuration
otherssh - refactor SSH internal processes and improved system stability
othersystem - improve handling of invalid SSL/TLS requests
othersystem - improve stability
fixtunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22)
otherwebfig - improve stability
otherwifi - updated radio regulatory information
fixwinbox - fix the "addresses" spelling in read-only fields
fixwireguard - fixed peer Tx/Rx counters
otherwireguard - generate port number when specified as zero
otherwireguard - reinitialize socket on VRF change
otherwww - improve stability
fixconsole - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal
fixethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22)
fixvrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip
fixbfd - fixed delay on session print
fixbgp - fixed advertisement print handling by "dst" when destination is in VRF
fixbgp - fixed IPv6 End-of-Route processing
otherbgp - improved stability on MP (multiprotocol) parsing
fixbridge - fixed dynamic VLAN update for wifi interfaces
fixbridge - fixed stability issue when using DHCPv4 snooping
othercloud - cloud backup file management now requires "policy" policy
fixconsole - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal
fixcontainer - fixed missing config.json issue when upgrading from version 7.20.8 or older
featuredisk - avoid reading SCSI stats all the time to allow disks to go to sleep
fixethernet - fixed stability issue with TSO on Alpine CPUs
otherethernet - improved system stability on devices with Alpine CPUs
otheripv6 - do not disable IPv6 FastPath when Traffic Flow is enabled
featureisis - allow to configure metric-type
fixisis - fixed missing "l2.lsp-refresh-interval" parameter
otherl3hw - improved system stability on device shutdown/reboot
fixlte - fixed cases where EC25-EU and EG25-G boards would receive packets with missing last 4 bytes
fixlte - fixed crash on LTE passthrough interface deactivation
fixospf - fixed interface passive flag update in WinBox
fixroute - fixed static route flag handling by WinBox on disable
deprecatedroute - removed deprecated "/routing/route/rule" menu
fixswitch - fixed issue with MAC table for RB2011 (introduced in v7.21)
fixswitch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs
otherswitch - increase "ingress-rate" and "egress-rate" maximum value to 400G
othertimezone - updated timezone information from "tzdata2026b" release
otherupgrade - prevent package scheduling from interfering with the upgrade feature
fixvxlan - fixed fast-path when using "checksum=no" (introduced in v7.20)
featurewinbox - do not pre-fill "Allowed Address" and "Client Allowed Address" with "::/0" when adding new WireGuard Peer
fixbgp - fixed stability issue when non-existent output select-chain was specified
featurebgp-vpn - allow modifying scopes with routing filters
fixbgp-vpn - fixed non-working import filter after reboot
otherbgp-vpn - use target scope for imported route
fixbridge - fixed missing dynamic "switch-cpu" VLAN entry in WiFi setup
fixbridge - fixed performance regression in complex setups with vlan-filtering (introduced in v7.20)
otherconsole - removed the "reset" command from shared settings menus (IP/IPv6/Bridge/L3HW/Neighbor-Discovery/Connection-Tracking)
fixcontainer - fixed issue where the container might not start after upgrading if root-dir was not set
othercontainer - improved error message if a container fails to start
fixdefconf - fixed L009 configuration (introduced in v7.21)
fixethernet - fixed false excessive broadcast warning (introduced in v7.20)
otherfirewall - improved system stability
otheripsec - improved aes256-ctr stability on L009
otheripsec - removed modp8192 proposal on MIPS architectures
otheripv6,ra - use received prefix when RA on-link flag is 0
otherisis - improved stability with fragmented CSNP
otherl2tp - improved system stability on TILE architecture
fixl3hw - fixed missing VLAN counters after reboot (introduced in v7.21)
fixl3hw - fixed stability issue (introduced in v7.21)
fixleds - fixed default LED configuration for CCR2004-1G-12S+2XS
otherlog - do not provide non-existent logging topics for configuration
fixlte - fixed framed route support for the first APN
fixlte - fixed missing automatic redial when cellular connectivity is lost for R11e-LTE
fixlte - fixed user set MTU not applied to LTE interface
fixospf - fixed typos in log messages
fixovpn - fixed OVPN push routes
fixpoe-out - fixed rare PoE-Out firmware upgrade failure on CRS354-48P-4S+2Q+
featureptp - allow manual domain configuration for 802.1AS profile
fixqos-hw - fixed "offline" tx-manager ability to queue at least one packet (introduced in v7.21)
featureroute - added SLAAC route redistribution for IPv6 capable routing protocols
fixrouterboard - fixed applying settings via WinBox on devices with fixed CPU frequency
featurerouting-filter - added possibility to match SLAAC and bgp-mpls-vpn route types
fixswitch - fixed stability issue when changing bridge multicast-router property on CRS1xx/2xx (introduced in v7.19)
featuresystem - added FCC Part 15 Compliance label to "System/Regulatory" menu
fixuser - properly apply login delay (introduced in v7.20)
fixwifi-mediatek - fixed communication issues on 802.11ax access points with Intel clients
fixwifi-mediatek - fixed HE capabilities IE on 2GHz band
fixwinbox - fixed "Remote AS" setting under the "Routing/BGP/Connections" menu
fixwinbox - fixed "Src/Dst Address Type" under the "IP/Firewall/NAT" menu
fixwinbox - fixed L3HW default value for VLAN interface (introduced in v7.21)
+16 more items in the release notesfixbgp - fixed route refresh subcode 0 warning
featurebgp - implement revised input error handling per RFC 7606
fixbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20.7)
fixcontainer - fixed nftables/iptables not working with "Message too long" error
fixhealth - fixed fan and PSU state logging for MIPSBE devices
otherpoe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces)
fixpoe-out - fixed PSU state recovery upon unplug/replug on CRS320
featureppp - added initial support for BG770A-GL modem firmware update
otherroute - prevent creating routing tables with the same name
fixrouting-filter - fixed num-set matcher
fixsfp - fixed sfp-ignore-rx-loss parameter for RB760iGS
fixsnmp - fixed handling of the script "dont-require-permissions" parameter when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput
fixsnmp - fixed permission error reporting when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput (introduced in v7.20.7)
fixsnmp - fixed script "run-count" update after execution
fixsystem - fixed rare partial loss of RouterOS configuration
otheruser-manager - properly release database backup file after backup creation
fixw60g - fixed possible memory leak when an interface is disabled
otherzerotier - improved route removal
fixbgp - fixed l2vpn-cisco decoding (introduced in v7.20)
fixbgp - fixed occasional corruption of MPLS labels in BGP VPN update messages
fixbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20)
fixbridge - improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20)
otherbth - make user private-key sensitive
fixconsole - fixed empty output in route menus when using "print where gateway"
otherconsole - updated copyright notice
otherfirewall - clear relevant masqueraded connection tracking entries on IP address change
otheripv6 - initialize RA receiving when enabled and without any other IPv6 configuration
fixlog - fixed memory leak
fixlte - fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20)
fixlte - fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17
fixovpn - fixed OVPN server handling on reboot (introduced in v7.20)
otherovpn - improved system stability when using cipher=blowfish128
fixsfp - fixed "sfp-tx-fault" state indication for CRS520-4XS-16XQ
fixsfp - fixed missing link up/down notifies
fixswitch - fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches
othersystem - detect policy mismatch sooner if script is executed internally by some other service
fixups - fixed board hibernation shutdown
featurewifi-mediatek - added Superchannel regulatory profile
otherbridge - improved system stability with IGMP snooping
otherethernet - improved performance for hEX Refresh and hEX S (2025)
otherike2 - improved system stability
fixleds - fixed signal strength LEDs for Cube 60G ac
featurelog - added VRF support for remote logging
featurelog - establish a new connection to the remote log server when action settings are edited (e.g. after changing the src-address property)
fixlog - fixed memory leak when a connection to remote TCP log server failed
fixlog - fixed unsent message retransmit to correct endpoints (introduced in v7.18)
otherlog - randomize source port when using remote logging with src-address specified
fixlte - fixed wrong subnet mask set to Chateau 5G R17 ax LTE interface
fixmac-server - fixed interface-list change behavior
featurepoe-out - added "poe-in" detection for 802.3at poe-out capable ports
otherpoe-out - firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces)
fixpoe-out - fixed "low-voltage" LLDP deny for RB5009 and RB960 in specific voltage/power-source combinations
fixpoe-out - fixed missing error status report in rare cases for 802.3at
fixrouterboot - fixed load of other kernels (e.g. OpenWrt) on NAND-less boards with MT762x, IPQ40xx, QCA955x and QCA953x CPUs ("/system routerboard upgrade" required)
fixsfp - fixed the I2C clock frequency for the hEX S (2025) to prevent EEPROM read issues with GPON modules
fixswitch - fixed switch name for CRS418
fixswitch - improved system stability after switch reset while bonding interfaces are active (introduced in v7.18)
featuretraffic-flow - added support for IPv6 packet sampling
fixtraffic-flow - fixed flow reports when using IPv6 and packet sampling (introduced in v7.18)
fixw60g - fixed disconnect issue (introduced in v7.19.4)
featurewinbox - allow selecting bonding interface under "Switch/Rule" menu
otherwinbox - use "auto" as default value for VXLAN "Don't Fragment" property
fixconsole - fixed issue with file-name completion (introduced in v7.18)
fixcontainer - fixed repository name handling to prevent redirect issues when basic authentication is used
fixlte - additional fixes for eSIM management support
otherlte - AT modems, improved redialing when modem lost connectivity without notifying host about APN status change
fixnetinstall - fixed socket reset (introduced in v7.18)
fixqueue - fixed system failure when CAKE kind queue was configured but queue type definition does not exist anymore (introduced in v7.18)
otherwifi - improved stability for wifi interfaces
otherwinbox - improve graphing efficiency when communicating with WinBox
fixdevice-mode - do not allow changing CPU frequency if "routerboard" is not allowed by device mode (introduced in v7.17)
fixdevice-mode - fixed feature and mode update via power-reset on PPC devices
fixdisk - fixed showing free space on tmpfs (introduced in v7.17)
fixdisk - improved system stability when SMB interface list is used (introduced in v7.17)
otherdns - do not show warning messages for DNS static entries when they are not needed
fixhotspot - fixed an issue where extra "flash/" is added to html-directory for devices with flash folders (introduced in v7.17)
othersfp - improved system stability with some GPON modules for CCR2004 and CCR2116 devices
fixsmb - fixed connection issues with clients using older SMB versions (introduced in v7.17)
fixswitch - fixed dynamic switch rules created by dot1x server (introduced in v7.17)
fixsystem - fixed a potential memory leak that occurred when resetting states after an error
othercertificate - do not download CRL if there is not enough free RAM
fixcertificate - fixed handling of capsman-cap certificates (introduced in v7.16)
featuredhcpv4-server/relay - added additional error messages for DHCP servers and relays
fixdns - fixed lookup order for static DNS entries (introduced in v7.16.1)
otherethernet - improved linking after reboot for hAP ax lite devices ("/system routerboard upgrade" required)
othergps - changed default GPS antenna setting for LtAP mini with internal LTE/GPS combo antenna
fixleds - fixed bogus argument for "leds" property (introduced in v7.16)
fixleds - fixed PoE-in LEDs for CRS318-1Fi-15Fr-2S device
othermodem - KNOT BG77 modem, improved handling of modem unexpected restarts
fixroute - fixed possible issue with inactive routes after reboot (introduced in v7.16)
otherrouterboot - improved stability for IPQ8072 and IPQ6010 when flash-boot is used ("/system routerboard upgrade" required)
fixlte - fixed possible crash when enabling/disabling config-less modem interface
fixlte - fixed R11e-LTE no traffic flow when modem with older firmware version is used
otherrouterboard - improved Etherboot stability for CRS320-8P-8B-4S+ device ("/system routerboard upgrade" required)
fixssh - fixed unsupported user SSH public key import (introduced in v7.15)
otherbgp - correctly synchronize input.accept-nlri address list
otherbridge - use default "edge=auto" for dynamically bridged interfaces (PPP, VPLS, WDS)
otherdisk - improved system stability
fixfetch - fixed slow throughput due to "raw" logging which occurred even when not listening to the topic (introduced in v7.13)
fixqueue - improved system stability (introduced in v7.6)
featurewifi-qcom - added configuration.distance setting to enable operation over multi-kilometer distances (CLI only)
fixbridge - fixed MLAG connection after peer-link flap (introduced in v7.13)
fixbridge - fixed packet forwarding after changing HW offloaded bridge interface settings in certain cases (introduced in v7.13)
fixdns - do not close connection with DoH server after query execution (introduced in v7.13.3)
fixleds - fixed modem signal strength for RBSXTR&R11e-LTE (introduced in v7.13)
othersms - increased SMS read timeout
otherwifi-qcom - improved memory allocating process
otherwifi-qcom - improved regulatory compliance for L11, L22 devices
otherwifi-qcom - improved system stability for L11, L22 devices
other(factory only release)
other(factory only release)