MikroTik RouterOS 7.20.7 → 7.25.1
14 releases · 2 breaking changes · 13 security fixes · 6 advisories fixed
13security2breaking1deprecated51feature110fix
Vulnerabilities fixed by this upgrade
- 8.2 CVE-2026-67277KEV RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra…
- 9.1 CVE-2026-67278 MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store include…
- 6.5 CVE-2026-67279KEV RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send…
- 7.5 CVE-2026-67281 RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.…
- 9.8 CVE-2026-86060KEV RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to…
- 8.1 CVE-2026-67276 RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig…
Breaking changes
- breaking lte - remove leftover APN slave interfaces when the master LTE interface is removed in 7.25
- breaking user - fix removal of inactive REST API sessions (introduced in 7.21) in 7.25
Security changes
- security system - improve stability (includes CVE-2026-98432) in 7.25.1
- security system - improve stability (includes CVE-2026-31431, CVE-2026-67280) in 7.25
- security winbox - add a Security tab and reorganize bridge and port dialogs in 7.25
- security system - improve stability (includes CVE-2026-98432) in 7.24.6
- security system - improve stability (includes CVE-2026-103903) in 7.24.5
- security system - improve stability (includes CVE-2026-84411, CVE-2026-103903) in 7.23.8
- security crypto - improve stability (CVE-2026-67278) in 7.23.6
- security user - improve failed login delay logic (CVE-2026-16347) in 7.23.6
- security Fixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to… in 7.23.4
- security Fixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra… in 7.23.4
- security Fixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send… in 7.23.4
- security Fixes CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig… in 7.23.4
- security Fixes CVE-2026-67281: RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.… in 7.23.4
Deprecations
- deprecated route - removed deprecated "/routing/route/rule" menu in 7.21.5
Every release in between
fixbridge - fix BPDUs leaking to the wrong dual-connected bond in MLAG (introduced in v7.24)
featurebridge - improve FDB synchronization between MLAG peers when VLANs are added
fixconsole - fix custom SSH client login parameters being ignored (introduced in v7.25)
fixdhcpv4-client - fix packet length calculation (introduced in v7.25)
fixdude - fix missing outage times and graph background scaling (introduced in v7.25)
fixfetch - fix HTTP fetch getting stuck in a "bad HTTP response" state
fixipsec - fix XFRM interfaces staying down until a reboot
fixipv6 - fix from-pool address lifetimes not updating after a prefix renewal (introduced in v7.25)
fixpim - fix IGMP/MLD querier being disabled after upgrade (introduced in v7.25)
fixptp - fix PTP support on CRS804-4DDQ
fixrouting-filter - fix host matching in address lists with more than 64 ranges
fixsfp - fix DAC EEPROM corruption when disabling 400G ports on CRS804 and CRS812 switches
fixssh - fix packet alignment when SHA-1 is used (introduced in v7.25)
securitysystem - improve stability (includes CVE-2026-98432)
fixwebfig - fix multi-value fields being displayed as empty (introduced in v7.25)
fixwifi - fix virtual interface restart loop when reselect-interval and reselect-time are configured (introduced in v7.25)
featureapp - add the networkRouterIP variable for container apps
featureapp - allow the privileged mode to be enabled per service in the container app YAML
featurebgp - add the always-compare-med setting
featurebridge - add dynamic ARP inspection
featurebridge - add IP source guard
featurebridge - add mlag-lacp-fallback and mlag-init-delay settings for MLAG
featurebridge - improve FDB synchronization between MLAG peers when VLANs are added
featurebth - add default client DNS and allowed IPs settings
featurebth - add resumable file uploads
featurecapsman - add hw-protection-threshold
featureconsole - allow the array access operator to accept arrays of indices or keys
featurecontainer - add a Ctrl-] escape sequence to exit a stuck container shell
featuredhcpv4-server - add ipv6-only-preferred parameter to respect option 108
featuredhcpv6-client - add option 39 with the client hostname
featuredhcpv6-server - add option 39 (FQDN) support and add-dns-entries option
featureethernet - add the arp-accept parameter for interfaces with MAC
featurefirewall - add NAT-related fields to CEF format logging
featureiot - add a GPIO menu in WinBox
featureiot - add Bluetooth output power control
featureiot - allow custom radio plan usage under regional lock
featureipsec - add XFRM interface support
featureleds - add dark-mode support for L41
featurelte - add band display support for Huawei ME909s modems
featurelte - add missing network error messages for MBIM modems
featurelte - add the sms-protocol=qmi option for sending and reading SMS
breakinglte - remove leftover APN slave interfaces when the master LTE interface is removed
featurenetinstall - add branding-and-custom-packages parameter for custom NPK packages
featurepim - add MLD support for PIM
featurepoe-out - add port-type field to poe monitor and print output
featureport - add an FTDI latency_timer option for low-latency serial applications
featureppp - add port interface info to PPP outbound channel defaults
featureptp - add support for fixed master and slave port roles
featureptp - add transparent clock mode
featuresnmp - add an OID and logging for blacklisted program access
featuresnmp - add CAPsMAN radio data to SNMP
featuresnmp - add dynamic SNMP engine ID assignment
featuresnmp - add interface table with mtu and l2mtu OIDs
securitysystem - improve stability (includes CVE-2026-31431, CVE-2026-67280)
breakinguser - fix removal of inactive REST API sessions (introduced in 7.21)
securitywinbox - add a Security tab and reorganize bridge and port dialogs
+248 more items in the release notesfixbridge - fix BPDUs leaking to the wrong dual-connected bond in MLAG (introduced in v7.24)
fixbridge - fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches
fixdude - fix the server not starting at boot when data-directory is on a USB disk
fixethernet - fix occasional packet loss on hAP be3 Media
fixfetch - fix HTTP fetch getting stuck in a "bad HTTP response" state
fixipsec - fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21)
fixipsec - fix IPsec tunnels failing after migration from the old QKD settings
fixipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder
fixptp - fix PTP support on CRS804-4DDQ
fixquickset - fix the WAN interface being selected incorrectly
otherroute - improve static route handling performance
fixrouting-filter - fix any-regexp community matcher matching an empty community attribute
fixrouting-filter - fix community delete, filter and modify with regexp-only community lists
fixrouting-filter - fix host matching in address lists with more than 64 ranges
fixsfp - fix DAC EEPROM corruption when disabling 400G ports on CRS804 and CRS812 switches
securitysystem - improve stability (includes CVE-2026-98432)
othersystem - stop the flash configuration store from growing on dynamic configuration changes
otherwifi - reuse freed station association IDs
fixwifi-mediatek - fix roaming between APs belonging to the same MLO group
fixwinbox - fix bridge filter window disabling valid fields for IPv6 rules
fixbridge - disable DHCP snooping ip binding table (introduced in v7.24)
otherbridge - enable vlan hardware offloading on hAP be3 Media device
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.24.3)
fixconsole - fix scheduler scripts with the default start date and time not being triggered (introduced in v7.24)
otherethernet - improve stability on hAP be3 Media device
otherlte - improve stability for MBIM modem mode switch
fixospf - fix unset interface template parameters not being applied to interfaces
fixpoe-out - fix loss of PoE-out capability on CRS328-24P-4S+ after a reboot
securitysystem - improve stability (includes CVE-2026-103903)
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.24.3)
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.23.6)
otherethernet - improved stability when forcing unsupported link speed
fixipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder
fixospf - fix unset interface template parameters not being applied to interfaces
fixquickset - fix the WAN interface being selected incorrectly
securitysystem - improve stability (includes CVE-2026-84411, CVE-2026-103903)
othersystem - stop the flash configuration store from growing on dynamic configuration changes
fixwifi - fix malformed management frame information elements advertising availability of multiple 6GHz APs
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.23.6)
otherbgp - improve stability
featurecertificate - add "SSL.com Root Certification Authority ECC" to built-in root certificate authorities store
featurecertificate - allow importing a cross-signed certificate without replacing the existing one
othercertificate - refactor certificate internal processes
othercertificate - remove "GoDaddy Class 2 CA" from built-in root certificate authorities store
otherconsole - improve stability
securitycrypto - improve stability (CVE-2026-67278)
fixipsec - fix duplicate connections on IKEv2 retransmissions
otheripsec - improve stability
fixleds - fix LEDs set to interface status staying off when the interface is active
otherppp - improve stability
featureptp - add manual configuration of PTP message intervals and per-port enabling and disabling
fixptp - fix PTP offset instability under heavy background multicast traffic
fixptp - fix PTP timestamps showing the wrong time on CRS510
othersfp - improve QSFP-DD breakout link establishing to NVIDIA DGX Spark and other devices
othersystem - improve stability
securityuser - improve failed login delay logic (CVE-2026-16347)
otherwifi - update radio regulatory information
otherwww - improve stability
fixdhcp - fixed IPv6 DHCP functionality (introduced in v7.23.4)
securityFixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to…
securityFixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra…
securityFixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send…
securityFixes CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig…
securityFixes CVE-2026-67281: RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.…
fixbgp - fix BGP link-local nexthops unreachable over a VRF and a crash when disabling an unnumbered connection
otherbtest - improve stability
fixcertificate - fix changing the built-in trust store setting (introduced in 7.22.2)
otherconsole - improve stability
otherdhcp - improve stability of DHCP handling
otherdisk - improve stability of the SMB server
otherfetch - improve stability of the TFTP client
fixipsec - fixed expired SA handling to prevent "no such item" errors during listing
otheripsec - improve IKE handshake stability
otherleds - improved interface stats activity for devices with Marvell Prestera switch chip
otherlte - removed extra restart after firmware upgrade for EC200A-EU modem
fixlte - fix the RG650E-EU modem not bringing link up after a firmware update
featureping - add parameter checks for arp ping
othersnmp - properly validate password length when applying configuration
otherssh - refactor SSH internal processes and improved system stability
othersystem - improve handling of invalid SSL/TLS requests
othersystem - improve stability
fixtunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22)
otherwebfig - improve stability
otherwifi - updated radio regulatory information
fixwinbox - fix the "addresses" spelling in read-only fields
fixwireguard - fixed peer Tx/Rx counters
otherwireguard - generate port number when specified as zero
otherwireguard - reinitialize socket on VRF change
otherwww - improve stability
fixconsole - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal
fixethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22)
fixvrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip
fixbfd - fixed delay on session print
fixbgp - fixed advertisement print handling by "dst" when destination is in VRF
fixbgp - fixed IPv6 End-of-Route processing
otherbgp - improved stability on MP (multiprotocol) parsing
fixbridge - fixed dynamic VLAN update for wifi interfaces
fixbridge - fixed stability issue when using DHCPv4 snooping
othercloud - cloud backup file management now requires "policy" policy
fixconsole - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal
fixcontainer - fixed missing config.json issue when upgrading from version 7.20.8 or older
featuredisk - avoid reading SCSI stats all the time to allow disks to go to sleep
fixethernet - fixed stability issue with TSO on Alpine CPUs
otherethernet - improved system stability on devices with Alpine CPUs
otheripv6 - do not disable IPv6 FastPath when Traffic Flow is enabled
featureisis - allow to configure metric-type
fixisis - fixed missing "l2.lsp-refresh-interval" parameter
otherl3hw - improved system stability on device shutdown/reboot
fixlte - fixed cases where EC25-EU and EG25-G boards would receive packets with missing last 4 bytes
fixlte - fixed crash on LTE passthrough interface deactivation
fixospf - fixed interface passive flag update in WinBox
fixroute - fixed static route flag handling by WinBox on disable
deprecatedroute - removed deprecated "/routing/route/rule" menu
fixswitch - fixed issue with MAC table for RB2011 (introduced in v7.21)
fixswitch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs
otherswitch - increase "ingress-rate" and "egress-rate" maximum value to 400G
othertimezone - updated timezone information from "tzdata2026b" release
otherupgrade - prevent package scheduling from interfering with the upgrade feature
fixvxlan - fixed fast-path when using "checksum=no" (introduced in v7.20)
featurewinbox - do not pre-fill "Allowed Address" and "Client Allowed Address" with "::/0" when adding new WireGuard Peer
fixbgp - fixed stability issue when non-existent output select-chain was specified
featurebgp-vpn - allow modifying scopes with routing filters
fixbgp-vpn - fixed non-working import filter after reboot
otherbgp-vpn - use target scope for imported route
fixbridge - fixed missing dynamic "switch-cpu" VLAN entry in WiFi setup
fixbridge - fixed performance regression in complex setups with vlan-filtering (introduced in v7.20)
otherconsole - removed the "reset" command from shared settings menus (IP/IPv6/Bridge/L3HW/Neighbor-Discovery/Connection-Tracking)
fixcontainer - fixed issue where the container might not start after upgrading if root-dir was not set
othercontainer - improved error message if a container fails to start
fixdefconf - fixed L009 configuration (introduced in v7.21)
fixethernet - fixed false excessive broadcast warning (introduced in v7.20)
otherfirewall - improved system stability
otheripsec - improved aes256-ctr stability on L009
otheripsec - removed modp8192 proposal on MIPS architectures
otheripv6,ra - use received prefix when RA on-link flag is 0
otherisis - improved stability with fragmented CSNP
otherl2tp - improved system stability on TILE architecture
fixl3hw - fixed missing VLAN counters after reboot (introduced in v7.21)
fixl3hw - fixed stability issue (introduced in v7.21)
fixleds - fixed default LED configuration for CCR2004-1G-12S+2XS
otherlog - do not provide non-existent logging topics for configuration
fixlte - fixed framed route support for the first APN
fixlte - fixed missing automatic redial when cellular connectivity is lost for R11e-LTE
fixlte - fixed user set MTU not applied to LTE interface
fixospf - fixed typos in log messages
fixovpn - fixed OVPN push routes
fixpoe-out - fixed rare PoE-Out firmware upgrade failure on CRS354-48P-4S+2Q+
featureptp - allow manual domain configuration for 802.1AS profile
fixqos-hw - fixed "offline" tx-manager ability to queue at least one packet (introduced in v7.21)
featureroute - added SLAAC route redistribution for IPv6 capable routing protocols
fixrouterboard - fixed applying settings via WinBox on devices with fixed CPU frequency
featurerouting-filter - added possibility to match SLAAC and bgp-mpls-vpn route types
fixswitch - fixed stability issue when changing bridge multicast-router property on CRS1xx/2xx (introduced in v7.19)
featuresystem - added FCC Part 15 Compliance label to "System/Regulatory" menu
fixuser - properly apply login delay (introduced in v7.20)
fixwifi-mediatek - fixed communication issues on 802.11ax access points with Intel clients
fixwifi-mediatek - fixed HE capabilities IE on 2GHz band
fixwinbox - fixed "Remote AS" setting under the "Routing/BGP/Connections" menu
fixwinbox - fixed "Src/Dst Address Type" under the "IP/Firewall/NAT" menu
fixwinbox - fixed L3HW default value for VLAN interface (introduced in v7.21)
+16 more items in the release notesfixbgp - fixed route refresh subcode 0 warning
featurebgp - implement revised input error handling per RFC 7606
fixbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20.7)
fixcontainer - fixed nftables/iptables not working with "Message too long" error
fixhealth - fixed fan and PSU state logging for MIPSBE devices
otherpoe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces)
fixpoe-out - fixed PSU state recovery upon unplug/replug on CRS320
featureppp - added initial support for BG770A-GL modem firmware update
otherroute - prevent creating routing tables with the same name
fixrouting-filter - fixed num-set matcher
fixsfp - fixed sfp-ignore-rx-loss parameter for RB760iGS
fixsnmp - fixed handling of the script "dont-require-permissions" parameter when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput
fixsnmp - fixed permission error reporting when executing scripts using MIKROTIK-MIB::mtxrScriptRunOutput (introduced in v7.20.7)
fixsnmp - fixed script "run-count" update after execution
fixsystem - fixed rare partial loss of RouterOS configuration
otheruser-manager - properly release database backup file after backup creation
fixw60g - fixed possible memory leak when an interface is disabled
otherzerotier - improved route removal