MikroTik RouterOS 7.8 → 7.20.7
12 releases · 0 breaking changes · 0 security fixes · 3 advisories fixed
0security0breaking0deprecated8feature54fix
Vulnerabilities fixed by this upgrade
- 7.2 CVE-2025-6443 Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Aut…
- 5.4 CVE-2024-54772 An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18.…
- 5.3 CVE-2023-41570 MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.
Breaking changes
None in the release notes.
Security changes
None in the release notes.
Every release in between
fixbgp - fixed l2vpn-cisco decoding (introduced in v7.20)
fixbgp - fixed occasional corruption of MPLS labels in BGP VPN update messages
fixbridge - fixed dynamic switch-cpu VLAN creation (introduced in v7.20)
fixbridge - improved system stability when forwarding traffic with fast-path and bridged interface gets removed or disabled (introduced in v7.20)
otherbth - make user private-key sensitive
fixconsole - fixed empty output in route menus when using "print where gateway"
otherconsole - updated copyright notice
otherfirewall - clear relevant masqueraded connection tracking entries on IP address change
otheripv6 - initialize RA receiving when enabled and without any other IPv6 configuration
fixlog - fixed memory leak
fixlte - fixed LTE interface IPv6 address generation to use EUI-64 (introduced in v7.20)
fixlte - fixed no re-connection after cellular network requested APN deactivation on Chateau 5G ax R17
fixovpn - fixed OVPN server handling on reboot (introduced in v7.20)
otherovpn - improved system stability when using cipher=blowfish128
fixsfp - fixed "sfp-tx-fault" state indication for CRS520-4XS-16XQ
fixsfp - fixed missing link up/down notifies
fixswitch - fixed non-IP multicast packet receive on 98DX8208, 98DX8216, 98DX8212, 98DX8332, 98DX3257, 98DX4310, 98DX8525, 98DX3255, 98CX8410 switches
othersystem - detect policy mismatch sooner if script is executed internally by some other service
fixups - fixed board hibernation shutdown
featurewifi-mediatek - added Superchannel regulatory profile
otherbridge - improved system stability with IGMP snooping
otherethernet - improved performance for hEX Refresh and hEX S (2025)
otherike2 - improved system stability
fixleds - fixed signal strength LEDs for Cube 60G ac
featurelog - added VRF support for remote logging
featurelog - establish a new connection to the remote log server when action settings are edited (e.g. after changing the src-address property)
fixlog - fixed memory leak when a connection to remote TCP log server failed
fixlog - fixed unsent message retransmit to correct endpoints (introduced in v7.18)
otherlog - randomize source port when using remote logging with src-address specified
fixlte - fixed wrong subnet mask set to Chateau 5G R17 ax LTE interface
fixmac-server - fixed interface-list change behavior
featurepoe-out - added "poe-in" detection for 802.3at poe-out capable ports
otherpoe-out - firmware update for 802.3at capable boards (the update will cause brief power interruption to poe-out interfaces)
fixpoe-out - fixed "low-voltage" LLDP deny for RB5009 and RB960 in specific voltage/power-source combinations
fixpoe-out - fixed missing error status report in rare cases for 802.3at
fixrouterboot - fixed load of other kernels (e.g. OpenWrt) on NAND-less boards with MT762x, IPQ40xx, QCA955x and QCA953x CPUs ("/system routerboard upgrade" required)
fixsfp - fixed the I2C clock frequency for the hEX S (2025) to prevent EEPROM read issues with GPON modules
fixswitch - fixed switch name for CRS418
fixswitch - improved system stability after switch reset while bonding interfaces are active (introduced in v7.18)
featuretraffic-flow - added support for IPv6 packet sampling
fixtraffic-flow - fixed flow reports when using IPv6 and packet sampling (introduced in v7.18)
fixw60g - fixed disconnect issue (introduced in v7.19.4)
featurewinbox - allow selecting bonding interface under "Switch/Rule" menu
otherwinbox - use "auto" as default value for VXLAN "Don't Fragment" property
fixconsole - fixed issue with file-name completion (introduced in v7.18)
fixcontainer - fixed repository name handling to prevent redirect issues when basic authentication is used
fixlte - additional fixes for eSIM management support
otherlte - AT modems, improved redialing when modem lost connectivity without notifying host about APN status change
fixnetinstall - fixed socket reset (introduced in v7.18)
fixqueue - fixed system failure when CAKE kind queue was configured but queue type definition does not exist anymore (introduced in v7.18)
otherwifi - improved stability for wifi interfaces
otherwinbox - improve graphing efficiency when communicating with WinBox
fixdevice-mode - do not allow changing CPU frequency if "routerboard" is not allowed by device mode (introduced in v7.17)
fixdevice-mode - fixed feature and mode update via power-reset on PPC devices
fixdisk - fixed showing free space on tmpfs (introduced in v7.17)
fixdisk - improved system stability when SMB interface list is used (introduced in v7.17)
otherdns - do not show warning messages for DNS static entries when they are not needed
fixhotspot - fixed an issue where extra "flash/" is added to html-directory for devices with flash folders (introduced in v7.17)
othersfp - improved system stability with some GPON modules for CCR2004 and CCR2116 devices
fixsmb - fixed connection issues with clients using older SMB versions (introduced in v7.17)
fixswitch - fixed dynamic switch rules created by dot1x server (introduced in v7.17)
fixsystem - fixed a potential memory leak that occurred when resetting states after an error
othercertificate - do not download CRL if there is not enough free RAM
fixcertificate - fixed handling of capsman-cap certificates (introduced in v7.16)
featuredhcpv4-server/relay - added additional error messages for DHCP servers and relays
fixdns - fixed lookup order for static DNS entries (introduced in v7.16.1)
otherethernet - improved linking after reboot for hAP ax lite devices ("/system routerboard upgrade" required)
othergps - changed default GPS antenna setting for LtAP mini with internal LTE/GPS combo antenna
fixleds - fixed bogus argument for "leds" property (introduced in v7.16)
fixleds - fixed PoE-in LEDs for CRS318-1Fi-15Fr-2S device
othermodem - KNOT BG77 modem, improved handling of modem unexpected restarts
fixroute - fixed possible issue with inactive routes after reboot (introduced in v7.16)
otherrouterboot - improved stability for IPQ8072 and IPQ6010 when flash-boot is used ("/system routerboard upgrade" required)
fixlte - fixed possible crash when enabling/disabling config-less modem interface
fixlte - fixed R11e-LTE no traffic flow when modem with older firmware version is used
otherrouterboard - improved Etherboot stability for CRS320-8P-8B-4S+ device ("/system routerboard upgrade" required)
fixssh - fixed unsupported user SSH public key import (introduced in v7.15)
otherbgp - correctly synchronize input.accept-nlri address list
otherbridge - use default "edge=auto" for dynamically bridged interfaces (PPP, VPLS, WDS)
otherdisk - improved system stability
fixfetch - fixed slow throughput due to "raw" logging which occurred even when not listening to the topic (introduced in v7.13)
fixqueue - improved system stability (introduced in v7.6)
featurewifi-qcom - added configuration.distance setting to enable operation over multi-kilometer distances (CLI only)
fixbridge - fixed MLAG connection after peer-link flap (introduced in v7.13)
fixbridge - fixed packet forwarding after changing HW offloaded bridge interface settings in certain cases (introduced in v7.13)
fixdns - do not close connection with DoH server after query execution (introduced in v7.13.3)
fixleds - fixed modem signal strength for RBSXTR&R11e-LTE (introduced in v7.13)
othersms - increased SMS read timeout
otherwifi-qcom - improved memory allocating process
otherwifi-qcom - improved regulatory compliance for L11, L22 devices
otherwifi-qcom - improved system stability for L11, L22 devices
other(factory only release)
other(factory only release)
fixwifiwave2 - fixed interface hangs on IPQ6010-based boards (introduced in v7.9)
otherrouterboard - improved RouterBOOT stability for Alpine CPUs ("/system routerboard upgrade" required)
othersfp - improved SFP interface handling for RB4011 device