MikroTik RouterOS 7.23.5 → 7.25.1
8 releases · 2 breaking changes · 8 security fixes · 1 advisory fixed
8security2breaking0deprecated40feature46fix
Vulnerabilities fixed by this upgrade
- 9.1 CVE-2026-67278 MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store include…
Breaking changes
- breaking lte - remove leftover APN slave interfaces when the master LTE interface is removed in 7.25
- breaking user - fix removal of inactive REST API sessions (introduced in 7.21) in 7.25
Security changes
- security system - improve stability (includes CVE-2026-98432) in 7.25.1
- security system - improve stability (includes CVE-2026-31431, CVE-2026-67280) in 7.25
- security winbox - add a Security tab and reorganize bridge and port dialogs in 7.25
- security system - improve stability (includes CVE-2026-98432) in 7.24.6
- security system - improve stability (includes CVE-2026-103903) in 7.24.5
- security system - improve stability (includes CVE-2026-84411, CVE-2026-103903) in 7.23.8
- security crypto - improve stability (CVE-2026-67278) in 7.23.6
- security user - improve failed login delay logic (CVE-2026-16347) in 7.23.6
Every release in between
fixbridge - fix BPDUs leaking to the wrong dual-connected bond in MLAG (introduced in v7.24)
featurebridge - improve FDB synchronization between MLAG peers when VLANs are added
fixconsole - fix custom SSH client login parameters being ignored (introduced in v7.25)
fixdhcpv4-client - fix packet length calculation (introduced in v7.25)
fixdude - fix missing outage times and graph background scaling (introduced in v7.25)
fixfetch - fix HTTP fetch getting stuck in a "bad HTTP response" state
fixipsec - fix XFRM interfaces staying down until a reboot
fixipv6 - fix from-pool address lifetimes not updating after a prefix renewal (introduced in v7.25)
fixpim - fix IGMP/MLD querier being disabled after upgrade (introduced in v7.25)
fixptp - fix PTP support on CRS804-4DDQ
fixrouting-filter - fix host matching in address lists with more than 64 ranges
fixsfp - fix DAC EEPROM corruption when disabling 400G ports on CRS804 and CRS812 switches
fixssh - fix packet alignment when SHA-1 is used (introduced in v7.25)
securitysystem - improve stability (includes CVE-2026-98432)
fixwebfig - fix multi-value fields being displayed as empty (introduced in v7.25)
fixwifi - fix virtual interface restart loop when reselect-interval and reselect-time are configured (introduced in v7.25)
featureapp - add the networkRouterIP variable for container apps
featureapp - allow the privileged mode to be enabled per service in the container app YAML
featurebgp - add the always-compare-med setting
featurebridge - add dynamic ARP inspection
featurebridge - add IP source guard
featurebridge - add mlag-lacp-fallback and mlag-init-delay settings for MLAG
featurebridge - improve FDB synchronization between MLAG peers when VLANs are added
featurebth - add default client DNS and allowed IPs settings
featurebth - add resumable file uploads
featurecapsman - add hw-protection-threshold
featureconsole - allow the array access operator to accept arrays of indices or keys
featurecontainer - add a Ctrl-] escape sequence to exit a stuck container shell
featuredhcpv4-server - add ipv6-only-preferred parameter to respect option 108
featuredhcpv6-client - add option 39 with the client hostname
featuredhcpv6-server - add option 39 (FQDN) support and add-dns-entries option
featureethernet - add the arp-accept parameter for interfaces with MAC
featurefirewall - add NAT-related fields to CEF format logging
featureiot - add a GPIO menu in WinBox
featureiot - add Bluetooth output power control
featureiot - allow custom radio plan usage under regional lock
featureipsec - add XFRM interface support
featureleds - add dark-mode support for L41
featurelte - add band display support for Huawei ME909s modems
featurelte - add missing network error messages for MBIM modems
featurelte - add the sms-protocol=qmi option for sending and reading SMS
breakinglte - remove leftover APN slave interfaces when the master LTE interface is removed
featurenetinstall - add branding-and-custom-packages parameter for custom NPK packages
featurepim - add MLD support for PIM
featurepoe-out - add port-type field to poe monitor and print output
featureport - add an FTDI latency_timer option for low-latency serial applications
featureppp - add port interface info to PPP outbound channel defaults
featureptp - add support for fixed master and slave port roles
featureptp - add transparent clock mode
featuresnmp - add an OID and logging for blacklisted program access
featuresnmp - add CAPsMAN radio data to SNMP
featuresnmp - add dynamic SNMP engine ID assignment
featuresnmp - add interface table with mtu and l2mtu OIDs
securitysystem - improve stability (includes CVE-2026-31431, CVE-2026-67280)
breakinguser - fix removal of inactive REST API sessions (introduced in 7.21)
securitywinbox - add a Security tab and reorganize bridge and port dialogs
+248 more items in the release notesfixbridge - fix BPDUs leaking to the wrong dual-connected bond in MLAG (introduced in v7.24)
fixbridge - fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches
fixdude - fix the server not starting at boot when data-directory is on a USB disk
fixethernet - fix occasional packet loss on hAP be3 Media
fixfetch - fix HTTP fetch getting stuck in a "bad HTTP response" state
fixipsec - fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21)
fixipsec - fix IPsec tunnels failing after migration from the old QKD settings
fixipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder
fixptp - fix PTP support on CRS804-4DDQ
fixquickset - fix the WAN interface being selected incorrectly
otherroute - improve static route handling performance
fixrouting-filter - fix any-regexp community matcher matching an empty community attribute
fixrouting-filter - fix community delete, filter and modify with regexp-only community lists
fixrouting-filter - fix host matching in address lists with more than 64 ranges
fixsfp - fix DAC EEPROM corruption when disabling 400G ports on CRS804 and CRS812 switches
securitysystem - improve stability (includes CVE-2026-98432)
othersystem - stop the flash configuration store from growing on dynamic configuration changes
otherwifi - reuse freed station association IDs
fixwifi-mediatek - fix roaming between APs belonging to the same MLO group
fixwinbox - fix bridge filter window disabling valid fields for IPv6 rules
fixbridge - disable DHCP snooping ip binding table (introduced in v7.24)
otherbridge - enable vlan hardware offloading on hAP be3 Media device
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.24.3)
fixconsole - fix scheduler scripts with the default start date and time not being triggered (introduced in v7.24)
otherethernet - improve stability on hAP be3 Media device
otherlte - improve stability for MBIM modem mode switch
fixospf - fix unset interface template parameters not being applied to interfaces
fixpoe-out - fix loss of PoE-out capability on CRS328-24P-4S+ after a reboot
securitysystem - improve stability (includes CVE-2026-103903)
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.24.3)
fixconsole - fix console output of /system/identity/print being split into multiple lines (introduced in v7.23.6)
otherethernet - improved stability when forcing unsupported link speed
fixipsec - fix IPsec tunnels not establishing when an address my-id is configured on the responder
fixospf - fix unset interface template parameters not being applied to interfaces
fixquickset - fix the WAN interface being selected incorrectly
securitysystem - improve stability (includes CVE-2026-84411, CVE-2026-103903)
othersystem - stop the flash configuration store from growing on dynamic configuration changes
fixwifi - fix malformed management frame information elements advertising availability of multiple 6GHz APs
otherwifi - update radio regulatory information
fixlte - prevent the modem firmware from being deleted for RBSXTLTE3-7, EC25-EU&KNe, EG25-G&KNe, EC25-EU&SXTsq, EG25-G&SXTsq (introduced in 7.23.6)
otherbgp - improve stability
featurecertificate - add "SSL.com Root Certification Authority ECC" to built-in root certificate authorities store
featurecertificate - allow importing a cross-signed certificate without replacing the existing one
othercertificate - refactor certificate internal processes
othercertificate - remove "GoDaddy Class 2 CA" from built-in root certificate authorities store
otherconsole - improve stability
securitycrypto - improve stability (CVE-2026-67278)
fixipsec - fix duplicate connections on IKEv2 retransmissions
otheripsec - improve stability
fixleds - fix LEDs set to interface status staying off when the interface is active
otherppp - improve stability
featureptp - add manual configuration of PTP message intervals and per-port enabling and disabling
fixptp - fix PTP offset instability under heavy background multicast traffic
fixptp - fix PTP timestamps showing the wrong time on CRS510
othersfp - improve QSFP-DD breakout link establishing to NVIDIA DGX Spark and other devices
othersystem - improve stability
securityuser - improve failed login delay logic (CVE-2026-16347)
otherwifi - update radio regulatory information
otherwww - improve stability