MikroTik RouterOS 7.12.2 → 7.21.5
11 releases · 0 breaking changes · 0 security fixes · 2 advisories fixed
0security0breaking1deprecated18feature106fix
Vulnerabilities fixed by this upgrade
- 7.2 CVE-2025-6443 Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Aut…
- 5.4 CVE-2024-54772 An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18.…
Breaking changes
None in the release notes.
Security changes
None in the release notes.
Deprecations
- deprecated route - removed deprecated "/routing/route/rule" menu in 7.21.5
Every release in between
fixbfd - fixed delay on session print
fixbgp - fixed advertisement print handling by "dst" when destination is in VRF
fixbgp - fixed IPv6 End-of-Route processing
otherbgp - improved stability on MP (multiprotocol) parsing
fixbridge - fixed dynamic VLAN update for wifi interfaces
fixbridge - fixed stability issue when using DHCPv4 snooping
othercloud - cloud backup file management now requires "policy" policy
fixconsole - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal
fixcontainer - fixed missing config.json issue when upgrading from version 7.20.8 or older
featuredisk - avoid reading SCSI stats all the time to allow disks to go to sleep
fixethernet - fixed stability issue with TSO on Alpine CPUs
otherethernet - improved system stability on devices with Alpine CPUs
otheripv6 - do not disable IPv6 FastPath when Traffic Flow is enabled
featureisis - allow to configure metric-type
fixisis - fixed missing "l2.lsp-refresh-interval" parameter
otherl3hw - improved system stability on device shutdown/reboot
fixlte - fixed cases where EC25-EU and EG25-G boards would receive packets with missing last 4 bytes
fixlte - fixed crash on LTE passthrough interface deactivation
fixospf - fixed interface passive flag update in WinBox
fixroute - fixed static route flag handling by WinBox on disable
deprecatedroute - removed deprecated "/routing/route/rule" menu
fixswitch - fixed issue with MAC table for RB2011 (introduced in v7.21)
fixswitch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs
otherswitch - increase "ingress-rate" and "egress-rate" maximum value to 400G
othertimezone - updated timezone information from "tzdata2026b" release
otherupgrade - prevent package scheduling from interfering with the upgrade feature
fixvxlan - fixed fast-path when using "checksum=no" (introduced in v7.20)
featurewinbox - do not pre-fill "Allowed Address" and "Client Allowed Address" with "::/0" when adding new WireGuard Peer
fixbgp - fixed stability issue when non-existent output select-chain was specified
featurebgp-vpn - allow modifying scopes with routing filters
fixbgp-vpn - fixed non-working import filter after reboot
otherbgp-vpn - use target scope for imported route
fixbridge - fixed missing dynamic "switch-cpu" VLAN entry in WiFi setup
fixbridge - fixed performance regression in complex setups with vlan-filtering (introduced in v7.20)
otherconsole - removed the "reset" command from shared settings menus (IP/IPv6/Bridge/L3HW/Neighbor-Discovery/Connection-Tracking)
fixcontainer - fixed issue where the container might not start after upgrading if root-dir was not set
othercontainer - improved error message if a container fails to start
fixdefconf - fixed L009 configuration (introduced in v7.21)
fixethernet - fixed false excessive broadcast warning (introduced in v7.20)
otherfirewall - improved system stability
otheripsec - improved aes256-ctr stability on L009
otheripsec - removed modp8192 proposal on MIPS architectures
otheripv6,ra - use received prefix when RA on-link flag is 0
otherisis - improved stability with fragmented CSNP
otherl2tp - improved system stability on TILE architecture
fixl3hw - fixed missing VLAN counters after reboot (introduced in v7.21)
fixl3hw - fixed stability issue (introduced in v7.21)
fixleds - fixed default LED configuration for CCR2004-1G-12S+2XS
otherlog - do not provide non-existent logging topics for configuration
fixlte - fixed framed route support for the first APN
fixlte - fixed missing automatic redial when cellular connectivity is lost for R11e-LTE
fixlte - fixed user set MTU not applied to LTE interface
fixospf - fixed typos in log messages
fixovpn - fixed OVPN push routes
fixpoe-out - fixed rare PoE-Out firmware upgrade failure on CRS354-48P-4S+2Q+
featureptp - allow manual domain configuration for 802.1AS profile
fixqos-hw - fixed "offline" tx-manager ability to queue at least one packet (introduced in v7.21)
featureroute - added SLAAC route redistribution for IPv6 capable routing protocols
fixrouterboard - fixed applying settings via WinBox on devices with fixed CPU frequency
featurerouting-filter - added possibility to match SLAAC and bgp-mpls-vpn route types
fixswitch - fixed stability issue when changing bridge multicast-router property on CRS1xx/2xx (introduced in v7.19)
featuresystem - added FCC Part 15 Compliance label to "System/Regulatory" menu
fixuser - properly apply login delay (introduced in v7.20)
fixwifi-mediatek - fixed communication issues on 802.11ax access points with Intel clients
fixwifi-mediatek - fixed HE capabilities IE on 2GHz band
fixwinbox - fixed "Remote AS" setting under the "Routing/BGP/Connections" menu
fixwinbox - fixed "Src/Dst Address Type" under the "IP/Firewall/NAT" menu
fixwinbox - fixed L3HW default value for VLAN interface (introduced in v7.21)
+16 more items in the release notesfixbgp - fixed route refresh subcode 0 warning
featurebgp - implement revised input error handling per RFC 7606
fixbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20.7)
fixcontainer - fixed nftables/iptables not working with "Message too long" error
fixhealth - fixed fan and PSU state logging for MIPSBE devices
otherpoe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces)
fixpoe-out - fixed PSU state recovery upon unplug/replug on CRS320
featureppp - added initial support for BG770A-GL modem firmware update
otherroute - prevent creating routing tables with the same name
fixrouting-filter - fixed num-set matcher
fixsfp - fixed sfp-ignore-rx-loss parameter for RB760iGS
fixsnmp - fixed handling of the script "dont-require-permissions" parameter when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput
fixsnmp - fixed permission error reporting when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput (introduced in v7.20.7)
fixsnmp - fixed script "run-count" update after execution
fixsystem - fixed rare partial loss of RouterOS configuration
otheruser-manager - properly release database backup file after backup creation
fixw60g - fixed possible memory leak when an interface is disabled
otherzerotier - improved route removal
fixbgp - fixed l2vpn-cisco decoding (introduced in v7.20)
fixbgp - fixed occasional corruption of MPLS labels in BGP VPN update messages
fixbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20)
fixbridge - improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20)
otherbth - make user private-key sensitive
fixconsole - fixed empty output in route menus when using "print where gateway"
otherconsole - updated copyright notice
otherfirewall - clear relevant masqueraded connection tracking entries on IP address change
otheripv6 - initialize RA receiving when enabled and without any other IPv6 configuration
fixlog - fixed memory leak
fixlte - fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20)
fixlte - fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17
fixovpn - fixed OVPN server handling on reboot (introduced in v7.20)
otherovpn - improved system stability when using cipher=blowfish128
fixsfp - fixed "sfp-tx-fault" state indication for CRS520-4XS-16XQ
fixsfp - fixed missing link up/down notifies
fixswitch - fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches
othersystem - detect policy mismatch sooner if script is executed internally by some other service
fixups - fixed board hibernation shutdown
featurewifi-mediatek - added Superchannel regulatory profile
otherbridge - improved system stability with IGMP snooping
otherethernet - improved performance for hEX Refresh and hEX S (2025)
otherike2 - improved system stability
fixleds - fixed signal strength LEDs for Cube 60G ac
featurelog - added VRF support for remote logging
featurelog - establish a new connection to the remote log server when action settings are edited (e.g. after changing the src-address property)
fixlog - fixed memory leak when a connection to remote TCP log server failed
fixlog - fixed unsent message retransmit to correct endpoints (introduced in v7.18)
otherlog - randomize source port when using remote logging with src-address specified
fixlte - fixed wrong subnet mask set to Chateau 5G R17 ax LTE interface
fixmac-server - fixed interface-list change behavior
featurepoe-out - added "poe-in" detection for 802.3at poe-out capable ports
otherpoe-out - firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces)
fixpoe-out - fixed "low-voltage" LLDP deny for RB5009 and RB960 in specific voltage/power-source combinations
fixpoe-out - fixed missing error status report in rare cases for 802.3at
fixrouterboot - fixed load of other kernels (e.g. OpenWrt) on NAND-less boards with MT762x, IPQ40xx, QCA955x and QCA953x CPUs ("/system routerboard upgrade" required)
fixsfp - fixed the I2C clock frequency for the hEX S (2025) to prevent EEPROM read issues with GPON modules
fixswitch - fixed switch name for CRS418
fixswitch - improved system stability after switch reset while bonding interfaces are active (introduced in v7.18)
featuretraffic-flow - added support for IPv6 packet sampling
fixtraffic-flow - fixed flow reports when using IPv6 and packet sampling (introduced in v7.18)
fixw60g - fixed disconnect issue (introduced in v7.19.4)
featurewinbox - allow selecting bonding interface under "Switch/Rule" menu
otherwinbox - use "auto" as default value for VXLAN "Don't Fragment" property
fixconsole - fixed issue with file-name completion (introduced in v7.18)
fixcontainer - fixed repository name handling to prevent redirect issues when basic authentication is used
fixlte - additional fixes for eSIM management support
otherlte - AT modems, improved redialing when modem lost connectivity without notifying host about APN status change
fixnetinstall - fixed socket reset (introduced in v7.18)
fixqueue - fixed system failure when CAKE kind queue was configured but queue type definition does not exist anymore (introduced in v7.18)
otherwifi - improved stability for wifi interfaces
otherwinbox - improve graphing efficiency when communicating with WinBox
fixdevice-mode - do not allow changing CPU frequency if "routerboard" is not allowed by device mode (introduced in v7.17)
fixdevice-mode - fixed feature and mode update via power-reset on PPC devices
fixdisk - fixed showing free space on tmpfs (introduced in v7.17)
fixdisk - improved system stability when SMB interface list is used (introduced in v7.17)
otherdns - do not show warning messages for DNS static entries when they are not needed
fixhotspot - fixed an issue where extra "flash/" is added to html-directory for devices with flash folders (introduced in v7.17)
othersfp - improved system stability with some GPON modules for CCR2004 and CCR2116 devices
fixsmb - fixed connection issues with clients using older SMB versions (introduced in v7.17)
fixswitch - fixed dynamic switch rules created by dot1x server (introduced in v7.17)
fixsystem - fixed a potential memory leak that occurred when resetting states after an error
othercertificate - do not download CRL if there is not enough free RAM
fixcertificate - fixed handling of capsman-cap certificates (introduced in v7.16)
featuredhcpv4-server/relay - added additional error messages for DHCP servers and relays
fixdns - fixed lookup order for static DNS entries (introduced in v7.16.1)
otherethernet - improved linking after reboot for hAP ax lite devices ("/system routerboard upgrade" required)
othergps - changed default GPS antenna setting for LtAP mini with internal LTE/GPS combo antenna
fixleds - fixed bogus argument for "leds" property (introduced in v7.16)
fixleds - fixed PoE-in LEDs for CRS318-1Fi-15Fr-2S device
othermodem - KNOT BG77 modem, improved handling of modem unexpected restarts
fixroute - fixed possible issue with inactive routes after reboot (introduced in v7.16)
otherrouterboot - improved stability for IPQ8072 and IPQ6010 when flash-boot is used ("/system routerboard upgrade" required)
fixlte - fixed possible crash when enabling/disabling config-less modem interface
fixlte - fixed R11e-LTE no traffic flow when modem with older firmware version is used
otherrouterboard - improved Etherboot stability for CRS320-8P-8B-4S+ device ("/system routerboard upgrade" required)
fixssh - fixed unsupported user SSH public key import (introduced in v7.15)
otherbgp - correctly synchronize input.accept-nlri address list
otherbridge - use default "edge=auto" for dynamically bridged interfaces (PPP, VPLS, WDS)
otherdisk - improved system stability
fixfetch - fixed slow throughput due to "raw" logging which occurred even when not listening to the topic (introduced in v7.13)
fixqueue - improved system stability (introduced in v7.6)
featurewifi-qcom - added configuration.distance setting to enable operation over multi-kilometer distances (CLI only)
fixbridge - fixed MLAG connection after peer-link flap (introduced in v7.13)
fixbridge - fixed packet forwarding after changing HW offloaded bridge interface settings in certain cases (introduced in v7.13)
fixdns - do not close connection with DoH server after query execution (introduced in v7.13.3)
fixleds - fixed modem signal strength for RBSXTR&R11e-LTE (introduced in v7.13)
othersms - increased SMS read timeout
otherwifi-qcom - improved memory allocating process
otherwifi-qcom - improved regulatory compliance for L11, L22 devices
otherwifi-qcom - improved system stability for L11, L22 devices