MikroTik RouterOS 7.21.4 → 7.25.1
12 releases · 2 breaking changes · 13 security fixes · 6 advisories fixed
13security2breaking1deprecated44feature73fix
Vulnerabilities fixed by this upgrade
- 8.2 CVE-2026-67277KEV RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra…
- 9.1 CVE-2026-67278 MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store include…
- 6.5 CVE-2026-67279KEV RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send…
- 7.5 CVE-2026-67281 RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.…
- 9.8 CVE-2026-86060KEV RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to…
- 8.1 CVE-2026-67276 RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig…
Breaking changes
- breaking lte - remove leftover APN slave interfaces when the master LTE interface is removed in 7.25
- breaking user - fix removal of inactive REST API sessions (introduced in 7.21) in 7.25
Security changes
- security system - improve stability (includes CVE-2026-98432) in 7.25.1
- security system - improve stability (includes CVE-2026-31431, CVE-2026-67280) in 7.25
- security winbox - add a Security tab and reorganize bridge and port dialogs in 7.25
- security system - improve stability (includes CVE-2026-98432) in 7.24.6
- security system - improve stability (includes CVE-2026-103903) in 7.24.5
- security system - improve stability (includes CVE-2026-84411, CVE-2026-103903) in 7.23.8
- security crypto - improve stability (CVE-2026-67278) in 7.23.6
- security user - improve failed login delay logic (CVE-2026-16347) in 7.23.6
- security Fixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to… in 7.23.4
- security Fixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra… in 7.23.4
- security Fixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send… in 7.23.4
- security Fixes CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig… in 7.23.4
- security Fixes CVE-2026-67281: RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.… in 7.23.4
Deprecations
- deprecated route - removed deprecated "/routing/route/rule" menu in 7.21.5
Every release in between
fixbridge - fix BPDUs leaking to the wrong dual-connected bond in MLAG (introduced in v7.24)
featurebridge - improve FDB synchronization between MLAG peers when VLANs are added
fixconsole - fix custom SSH client login parameters being ignored (introduced in v7.25)
fixdhcpv4-client - fix packet length calculation (introduced in v7.25)
fixdude - fix missing outage times and graph background scaling (introduced in v7.25)
fixfetch - fix HTTP fetch getting stuck in a "bad HTTP response" state
fixipsec - fix XFRM interfaces staying down until a reboot
fixipv6 - fix from-pool address lifetimes not updating after a prefix renewal (introduced in v7.25)
fixpim - fix IGMP/MLD querier being disabled after upgrade (introduced in v7.25)
fixptp - fix PTP support on CRS804-4DDQ
fixrouting-filter - fix host matching in address lists with more than 64 ranges
fixsfp - fix DAC EEPROM corruption when disabling 400G ports on CRS804 and CRS812 switches
fixssh - fix packet alignment when SHA-1 is used (introduced in v7.25)
securitysystem - improve stability (includes CVE-2026-98432)
fixwebfig - fix multi-value fields being displayed as empty (introduced in v7.25)
fixwifi - fix virtual interface restart loop when reselect-interval and reselect-time are configured (introduced in v7.25)
featureapp - add the networkRouterIP variable for container apps
featureapp - allow the privileged mode to be enabled per service in the container app YAML
featurebgp - add the always-compare-med setting
featurebridge - add dynamic ARP inspection
featurebridge - add IP source guard
featurebridge - add mlag-lacp-fallback and mlag-init-delay settings for MLAG
featurebridge - improve FDB synchronization between MLAG peers when VLANs are added
featurebth - add default client DNS and allowed IPs settings
featurebth - add resumable file uploads
featurecapsman - add hw-protection-threshold
featureconsole - allow the array access operator to accept arrays of indices or keys
featurecontainer - add a Ctrl-] escape sequence to exit a stuck container shell
featuredhcpv4-server - add ipv6-only-preferred parameter to respect option 108
featuredhcpv6-client - add option 39 with the client hostname
featuredhcpv6-server - add option 39 (FQDN) support and add-dns-entries option
featureethernet - add the arp-accept parameter for interfaces with MAC
featurefirewall - add NAT-related fields to CEF format logging
featureiot - add a GPIO menu in WinBox
featureiot - add Bluetooth output power control
featureiot - allow custom radio plan usage under regional lock
featureipsec - add XFRM interface support
featureleds - add dark-mode support for L41
featurelte - add band display support for Huawei ME909s modems
featurelte - add missing network error messages for MBIM modems
featurelte - add the sms-protocol=qmi option for sending and reading SMS
breakinglte - remove leftover APN slave interfaces when the master LTE interface is removed
featurenetinstall - add branding-and-custom-packages parameter for custom NPK packages
featurepim - add MLD support for PIM
featurepoe-out - add port-type field to poe monitor and print output
featureport - add an FTDI latency_timer option for low-latency serial applications
featureppp - add port interface info to PPP outbound channel defaults
featureptp - add support for fixed master and slave port roles
featureptp - add transparent clock mode
featuresnmp - add an OID and logging for blacklisted program access
featuresnmp - add CAPsMAN radio data to SNMP
featuresnmp - add dynamic SNMP engine ID assignment
featuresnmp - add interface table with mtu and l2mtu OIDs
securitysystem - improve stability (includes CVE-2026-31431, CVE-2026-67280)
breakinguser - fix removal of inactive REST API sessions (introduced in 7.21)
securitywinbox - add a Security tab and reorganize bridge and port dialogs
+248 more items in the release notesfixbridge - fix BPDUs leaking to the wrong dual-connected bond in MLAG (introduced in v7.24)
fixbridge - fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches
fixdude - fix the server not starting at boot when data-directory is on a USB disk
fixethernet - fix occasional packet loss on hAP be3 Media
fixfetch - fix HTTP fetch getting stuck in a "bad HTTP response" state
fixipsec - fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21)
fixipsec - fix IPsec tunnels failing after migration from the old QKD settings
fixipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder
fixptp - fix PTP support on CRS804-4DDQ
fixquickset - fix the WAN interface being selected incorrectly
otherroute - improve static route handling performance
fixrouting-filter - fix any-regexp community matcher matching an empty community attribute
fixrouting-filter - fix community delete, filter and modify with regexp-only community lists
fixrouting-filter - fix host matching in address lists with more than 64 ranges
fixsfp - fix DAC EEPROM corruption when disabling 400G ports on CRS804 and CRS812 switches
securitysystem - improve stability (includes CVE-2026-98432)
othersystem - stop the flash configuration store from growing on dynamic configuration changes
otherwifi - reuse freed station association IDs
fixwifi-mediatek - fix roaming between APs belonging to the same MLO group
fixwinbox - fix bridge filter window disabling valid fields for IPv6 rules
fixbridge - disable DHCP snooping ip binding table (introduced in v7.24)
otherbridge - enable vlan hardware offloading on hAP be3 Media device
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.24.3)
fixconsole - fix scheduler scripts with the default start date and time not being triggered (introduced in v7.24)
otherethernet - improve stability on hAP be3 Media device
otherlte - improve stability for MBIM modem mode switch
fixospf - fix unset interface template parameters not being applied to interfaces
fixpoe-out - fix loss of PoE-out capability on CRS328-24P-4S+ after a reboot
securitysystem - improve stability (includes CVE-2026-103903)
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.24.3)
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.23.6)
otherethernet - improved stability when forcing unsupported link speed
fixipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder
fixospf - fix unset interface template parameters not being applied to interfaces
fixquickset - fix the WAN interface being selected incorrectly
securitysystem - improve stability (includes CVE-2026-84411, CVE-2026-103903)
othersystem - stop the flash configuration store from growing on dynamic configuration changes
fixwifi - fix malformed management frame information elements advertising availability of multiple 6GHz APs
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.23.6)
otherbgp - improve stability
featurecertificate - add "SSL.com Root Certification Authority ECC" to built-in root certificate authorities store
featurecertificate - allow importing a cross-signed certificate without replacing the existing one
othercertificate - refactor certificate internal processes
othercertificate - remove "GoDaddy Class 2 CA" from built-in root certificate authorities store
otherconsole - improve stability
securitycrypto - improve stability (CVE-2026-67278)
fixipsec - fix duplicate connections on IKEv2 retransmissions
otheripsec - improve stability
fixleds - fix LEDs set to interface status staying off when the interface is active
otherppp - improve stability
featureptp - add manual configuration of PTP message intervals and per-port enabling and disabling
fixptp - fix PTP offset instability under heavy background multicast traffic
fixptp - fix PTP timestamps showing the wrong time on CRS510
othersfp - improve QSFP-DD breakout link establishing to NVIDIA DGX Spark and other devices
othersystem - improve stability
securityuser - improve failed login delay logic (CVE-2026-16347)
otherwifi - update radio regulatory information
otherwww - improve stability
fixdhcp - fixed IPv6 DHCP functionality (introduced in v7.23.4)
securityFixes CVE-2026-86060: RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to…
securityFixes CVE-2026-67277: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "ra…
securityFixes CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send…
securityFixes CVE-2026-67276: RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because sig…
securityFixes CVE-2026-67281: RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization.…
fixbgp - fix BGP link-local nexthops unreachable over a VRF and a crash when disabling an unnumbered connection
otherbtest - improve stability
fixcertificate - fix changing the built-in trust store setting (introduced in 7.22.2)
otherconsole - improve stability
otherdhcp - improve stability of DHCP handling
otherdisk - improve stability of the SMB server
otherfetch - improve stability of the TFTP client
fixipsec - fixed expired SA handling to prevent "no such item" errors during listing
otheripsec - improve IKE handshake stability
otherleds - improved interface stats activity for devices with Marvell Prestera switch chip
otherlte - removed extra restart after firmware upgrade for EC200A-EU modem
fixlte - fix the RG650E-EU modem not bringing link up after a firmware update
featureping - add parameter checks for arp ping
othersnmp - properly validate password length when applying configuration
otherssh - refactor SSH internal processes and improved system stability
othersystem - improve handling of invalid SSL/TLS requests
othersystem - improve stability
fixtunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22)
otherwebfig - improve stability
otherwifi - updated radio regulatory information
fixwinbox - fix the "addresses" spelling in read-only fields
fixwireguard - fixed peer Tx/Rx counters
otherwireguard - generate port number when specified as zero
otherwireguard - reinitialize socket on VRF change
otherwww - improve stability
fixconsole - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal
fixethernet - fixed stability issue after switch reset on devices with IPQ-40xx, IPQ-60xx CPUs (introduced in v7.22)
fixvrrp - fixed stability issue when using VRRP with a hardware-offloaded bridge for Marvell Prestera switch chip
fixbfd - fixed delay on session print
fixbgp - fixed advertisement print handling by "dst" when destination is in VRF
fixbgp - fixed IPv6 End-of-Route processing
otherbgp - improved stability on MP (multiprotocol) parsing
fixbridge - fixed dynamic VLAN update for wifi interfaces
fixbridge - fixed stability issue when using DHCPv4 snooping
othercloud - cloud backup file management now requires "policy" policy
fixconsole - fixed unresponsiveness when entering safe-mode through the Windows 11 terminal
fixcontainer - fixed missing config.json issue when upgrading from version 7.20.8 or older
featuredisk - avoid reading SCSI stats all the time to allow disks to go to sleep
fixethernet - fixed stability issue with TSO on Alpine CPUs
otherethernet - improved system stability on devices with Alpine CPUs
otheripv6 - do not disable IPv6 FastPath when Traffic Flow is enabled
featureisis - allow to configure metric-type
fixisis - fixed missing "l2.lsp-refresh-interval" parameter
otherl3hw - improved system stability on device shutdown/reboot
fixlte - fixed cases where EC25-EU and EG25-G boards would receive packets with missing last 4 bytes
fixlte - fixed crash on LTE passthrough interface deactivation
fixospf - fixed interface passive flag update in WinBox
fixroute - fixed static route flag handling by WinBox on disable
deprecatedroute - removed deprecated "/routing/route/rule" menu
fixswitch - fixed issue with MAC table for RB2011 (introduced in v7.21)
fixswitch - fixed rare possibility of tx-timeout or simultaneous flap of all switch ports on devices with Alpine CPUs
otherswitch - increase "ingress-rate" and "egress-rate" maximum value to 400G
othertimezone - updated timezone information from "tzdata2026b" release
otherupgrade - prevent package scheduling from interfering with the upgrade feature
fixvxlan - fixed fast-path when using "checksum=no" (introduced in v7.20)
featurewinbox - do not pre-fill "Allowed Address" and "Client Allowed Address" with "::/0" when adding new WireGuard Peer