MikroTik RouterOS 7.12.2 → 7.20.7
8 releases · 0 breaking changes · 0 security fixes · 2 advisories fixed
0security0breaking0deprecated8feature53fix
Vulnerabilities fixed by this upgrade
- 7.2 CVE-2025-6443 Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Aut…
- 5.4 CVE-2024-54772 An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18.…
Breaking changes
None in the release notes.
Security changes
None in the release notes.
Every release in between
fixbgp - fixed l2vpn-cisco decoding (introduced in v7.20)
fixbgp - fixed occasional corruption of MPLS labels in BGP VPN update messages
fixbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20)
fixbridge - improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20)
otherbth - make user private-key sensitive
fixconsole - fixed empty output in route menus when using "print where gateway"
otherconsole - updated copyright notice
otherfirewall - clear relevant masqueraded connection tracking entries on IP address change
otheripv6 - initialize RA receiving when enabled and without any other IPv6 configuration
fixlog - fixed memory leak
fixlte - fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20)
fixlte - fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17
fixovpn - fixed OVPN server handling on reboot (introduced in v7.20)
otherovpn - improved system stability when using cipher=blowfish128
fixsfp - fixed "sfp-tx-fault" state indication for CRS520-4XS-16XQ
fixsfp - fixed missing link up/down notifies
fixswitch - fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches
othersystem - detect policy mismatch sooner if script is executed internally by some other service
fixups - fixed board hibernation shutdown
featurewifi-mediatek - added Superchannel regulatory profile
otherbridge - improved system stability with IGMP snooping
otherethernet - improved performance for hEX Refresh and hEX S (2025)
otherike2 - improved system stability
fixleds - fixed signal strength LEDs for Cube 60G ac
featurelog - added VRF support for remote logging
featurelog - establish a new connection to the remote log server when action settings are edited (e.g. after changing the src-address property)
fixlog - fixed memory leak when a connection to remote TCP log server failed
fixlog - fixed unsent message retransmit to correct endpoints (introduced in v7.18)
otherlog - randomize source port when using remote logging with src-address specified
fixlte - fixed wrong subnet mask set to Chateau 5G R17 ax LTE interface
fixmac-server - fixed interface-list change behavior
featurepoe-out - added "poe-in" detection for 802.3at poe-out capable ports
otherpoe-out - firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces)
fixpoe-out - fixed "low-voltage" LLDP deny for RB5009 and RB960 in specific voltage/power-source combinations
fixpoe-out - fixed missing error status report in rare cases for 802.3at
fixrouterboot - fixed load of other kernels (e.g. OpenWrt) on NAND-less boards with MT762x, IPQ40xx, QCA955x and QCA953x CPUs ("/system routerboard upgrade" required)
fixsfp - fixed the I2C clock frequency for the hEX S (2025) to prevent EEPROM read issues with GPON modules
fixswitch - fixed switch name for CRS418
fixswitch - improved system stability after switch reset while bonding interfaces are active (introduced in v7.18)
featuretraffic-flow - added support for IPv6 packet sampling
fixtraffic-flow - fixed flow reports when using IPv6 and packet sampling (introduced in v7.18)
fixw60g - fixed disconnect issue (introduced in v7.19.4)
featurewinbox - allow selecting bonding interface under "Switch/Rule" menu
otherwinbox - use "auto" as default value for VXLAN "Don't Fragment" property
fixconsole - fixed issue with file-name completion (introduced in v7.18)
fixcontainer - fixed repository name handling to prevent redirect issues when basic authentication is used
fixlte - additional fixes for eSIM management support
otherlte - AT modems, improved redialing when modem lost connectivity without notifying host about APN status change
fixnetinstall - fixed socket reset (introduced in v7.18)
fixqueue - fixed system failure when CAKE kind queue was configured but queue type definition does not exist anymore (introduced in v7.18)
otherwifi - improved stability for wifi interfaces
otherwinbox - improve graphing efficiency when communicating with WinBox
fixdevice-mode - do not allow changing CPU frequency if "routerboard" is not allowed by device mode (introduced in v7.17)
fixdevice-mode - fixed feature and mode update via power-reset on PPC devices
fixdisk - fixed showing free space on tmpfs (introduced in v7.17)
fixdisk - improved system stability when SMB interface list is used (introduced in v7.17)
otherdns - do not show warning messages for DNS static entries when they are not needed
fixhotspot - fixed an issue where extra "flash/" is added to html-directory for devices with flash folders (introduced in v7.17)
othersfp - improved system stability with some GPON modules for CCR2004 and CCR2116 devices
fixsmb - fixed connection issues with clients using older SMB versions (introduced in v7.17)
fixswitch - fixed dynamic switch rules created by dot1x server (introduced in v7.17)
fixsystem - fixed a potential memory leak that occurred when resetting states after an error
othercertificate - do not download CRL if there is not enough free RAM
fixcertificate - fixed handling of capsman-cap certificates (introduced in v7.16)
featuredhcpv4-server/relay - added additional error messages for DHCP servers and relays
fixdns - fixed lookup order for static DNS entries (introduced in v7.16.1)
otherethernet - improved linking after reboot for hAP ax lite devices ("/system routerboard upgrade" required)
othergps - changed default GPS antenna setting for LtAP mini with internal LTE/GPS combo antenna
fixleds - fixed bogus argument for "leds" property (introduced in v7.16)
fixleds - fixed PoE-in LEDs for CRS318-1Fi-15Fr-2S device
othermodem - KNOT BG77 modem, improved handling of modem unexpected restarts
fixroute - fixed possible issue with inactive routes after reboot (introduced in v7.16)
otherrouterboot - improved stability for IPQ8072 and IPQ6010 when flash-boot is used ("/system routerboard upgrade" required)
fixlte - fixed possible crash when enabling/disabling config-less modem interface
fixlte - fixed R11e-LTE no traffic flow when modem with older firmware version is used
otherrouterboard - improved Etherboot stability for CRS320-8P-8B-4S+ device ("/system routerboard upgrade" required)
fixssh - fixed unsupported user SSH public key import (introduced in v7.15)
otherbgp - correctly synchronize input.accept-nlri address list
otherbridge - use default "edge=auto" for dynamically bridged interfaces (PPP, VPLS, WDS)
otherdisk - improved system stability
fixfetch - fixed slow throughput due to "raw" logging which occurred even when not listening to the topic (introduced in v7.13)
fixqueue - improved system stability (introduced in v7.6)
featurewifi-qcom - added configuration.distance setting to enable operation over multi-kilometer distances (CLI only)
fixbridge - fixed MLAG connection after peer-link flap (introduced in v7.13)
fixbridge - fixed packet forwarding after changing HW offloaded bridge interface settings in certain cases (introduced in v7.13)
fixdns - do not close connection with DoH server after query execution (introduced in v7.13.3)
fixleds - fixed modem signal strength for RBSXTR&R11e-LTE (introduced in v7.13)
othersms - increased SMS read timeout
otherwifi-qcom - improved memory allocating process
otherwifi-qcom - improved regulatory compliance for L11, L22 devices
otherwifi-qcom - improved system stability for L11, L22 devices