Mikrotik RouterOS 7.25 stable

Nuovo aggiornamento della versione stable di casa Mikrotik.

Nuovo aggiornamento in casa Mikrotik.

Ecco il changelog ufficiale:

What’s new in 7.25 (2026-10-22):

*) app – add the networkRouterIP variable for container apps;
*) app – allow the privileged mode to be enabled per service in the container app YAML;
*) app – fix CHR apps getting stuck on “starting” on slower boards;
*) app – show an error when an app variable cannot be resolved;
*) app – update the environment variables of the docker-with-komodo app;
*) bgp – add the always-compare-med setting;
*) bgp – fix BGP unnumbered connections within a VRF;
*) bgp – include the VNI number in outgoing EVPN routes;
*) bgp – log failed BGP connection attempts;
*) bgp – show interface names and VRF names in BGP logs;
*) bridge – add dynamic ARP inspection;
*) bridge – add IP source guard;
*) bridge – add mlag-lacp-fallback and mlag-init-delay settings for MLAG;
*) bridge – fix a false “already added as bridge port” error;
*) bridge – fix an MLAG peer getting stuck in the disabled state after config changes;
*) bridge – fix bridge ports not forwarding;
*) bridge – fix fragmented IPv6 traffic being dropped by DHCPv6 snooping (introduced in v7.23);
*) bridge – fix VRRP MAC behavior in MLAG setups;
*) bridge – improve FDB synchronization between MLAG peers when VLANs are added;
*) bridge – make MVRP work with MLAG dual bonds;
*) bridge – make the DHCP snooping log messages clearer and informative;
*) bridge – rename the IGMP last-member-interval property to last-member-query-interval;
*) bridge – warn about VLAN entries when vlan-filtering is disabled;
*) bth – add default client DNS and allowed IPs settings;
*) bth – add resumable file uploads;
*) bth – check the available disk space before a file upload;
*) bth – fix file share issues when enabled through WinBox files menu;
*) bth – fix the file share getting stuck when disabling;
*) bth – return upload errors in JSON format;
*) capsman – add hw-protection-threshold;
*) capsman – fix the last-ip value being shown backwards;
*) certificate – fix ACME certificate issuance for wildcard domains;
*) certificate – refactor certificate internal processes;
*) console – allow the array access operator to accept arrays of indices or keys;
*) console – expose globals in the API;
*) console – fix background “:execute as-string” jobs not terminating on interrupt;
*) console – fix comment wrapping in the monitor command;
*) console – fix inconsistent /ip/firewall/filter print with src-address-list and dst-address-list;
*) console – fix the where filter ignoring flags set to false;
*) console – improve export order;
*) console – improve stability when running scripts from Dude;
*) console – prevent an out-of-memory condition when “:execute as-string” produces large output;
*) console – prevent duplicate entries in /port/remote-access;
*) container – add a Ctrl-] escape sequence to exit a stuck container shell;
*) container – fix container interface handling on CHR;
*) container – fix veth interface left running after restarting a stopped container;
*) container – require the container device-mode to enable swap;
*) crypto – fix a possible crash during IPsec processing on Qualcomm devices;
*) defconf – fix button script policies;
*) defconf – fix default configuration generation when CRS8xx series switch ports initialize late;
*) detnet – use a single random source port;
*) dhcpv4-client – ignore forcerenew packets that are not unicasted to client;
*) dhcpv4-server – add ipv6-only-preferred parameter to respect option 108;
*) dhcpv4-server – show DHCP option 82 parameters in ASCII in addition to hex;
*) dhcpv6-client – add option 39 with the client hostname;
*) dhcpv6-client – fix DHCPv6 client address handling after prefix-hint changes;
*) dhcpv6-client – remove a duplicate dhcp-options parameter;
*) dhcpv6-relay – use the packet’s source MAC for option 79 if relay and client are on the same link layer;
*) dhcpv6-server – add option 39 (FQDN) support and add-dns-entries option;
*) dhcpv6-server – fix send-reconfigure for DHCPv6 clients behind a relay;
*) disk – fix all-zero NGUIDs on NVMe over TCP exported namespaces;
*) disk – improve RAID5/6 throughput;
*) dns – fix resolving domain names that end with a dot;
*) dot1x – rename the reauth-timeout to reauth-period;
*) dude – fix the server not starting at boot when data-directory is on a USB disk;
*) email – fix server certificate verification;
*) email – show certificate related errors in the log;
*) ethernet – add the arp-accept parameter for interfaces with MAC;
*) ethernet – fix a stability issue on RB1100AHx2 under heavy traffic;
*) ethernet – fix bogus fast-path Rx traffic reported on an unconnected ether8 port on RB5009;
*) ethernet – fix link flap and unexpected reboots on RB5009;
*) ethernet – fix occasional packet loss on hAP be3 Media;
*) ethernet – fix PPPoE link flapping on Intel X710;
*) ethernet – fix PPPoE over VLAN not working on Mellanox ConnectX-4;
*) ethernet – fix SFP compatibility on hAP ax S and hEX S (2025) devices;
*) ethernet – improve stability on x86 routers with Mellanox NICs;
*) evpn – publish MAC-IP routes (RT-2) for neighbors;
*) fetch – improve upload state reporting when using sftp;
*) fetch – never set a cookie jar for HTTP requests;
*) fetch – show a clearer error when keep-result and output are both used;
*) firewall – add NAT-related fields to CEF format logging;
*) hardware – show the device name and location in /system/resource/hardware menu;
*) igmp-proxy – improve stability when changing /routing/igmp-proxy parameters;
*) iot – add a GPIO menu in WinBox;
*) iot – add Bluetooth output power control;
*) iot – allow custom radio plan usage under regional lock;
*) iot – enforce the fixed antenna gain on boards with an embedded antenna;
*) iot – fix round-trip-time timing issues in LoRaWAN Basic Station;
*) ip-service – fix services becoming unreachable after their VRF is disabled and re-enabled;
*) ipsec – add XFRM interface support;
*) ipsec – fix IKEv1 tunnels failing to establish when the commit bit is set;
*) ipsec – fix IKEv2 EAP-TTLS client failing with invalid trust store (introduced in v7.21);
*) ipsec – fix IPsec tunnels failing after migration from the old QKD settings;
*) ipsec – fix policy and SA handling after moving it to netlink;
*) ipv6 – fix a failure when releasing DHCPv6 prefix delegation pools;
*) ipv6 – fix cases when address is lost after reboot if prefix was taken from pool;
*) ipv6 – fix missing IPv6 link-local addresses on some interfaces when the device is busy during boot;
*) ipv6 – fix the DNS timer in router advertisements;
*) ipv6 – ignore router advertisements received on interfaces not in the accepting list;
*) l3hw – fix IPv6 link-local traffic being routed incorrectly;
*) l3hw – improve stability of L3 hardware offload when using IPv4-mapped IPv6 addresses;
*) l3hw – optimize ECMP nexthop offloading;
*) lcd – improve stability when an SFP reports an unknown link speed;
*) leds – add dark-mode support for L41;
*) leds – fix missing LED triggers when an R11e card is installed;
*) lte – accept both y and yes for eSIM confirmation;
*) lte – add band display support for Huawei ME909s modems;
*) lte – add missing network error messages for MBIM modems;
*) lte – add the sms-protocol=qmi option for sending and reading SMS;
*) lte – do not force reconfiguration on roaming network when roaming is disabled;
*) lte – fix LTE interfaces disappearing after FOTA updates;
*) lte – fix missing MAC address on QMI LTE interfaces after the interface is recreated (introduced in v7.24.4);
*) lte – fix missing new firmware update notification on some modems;
*) lte – fix multi-APN connections not passing traffic on AT modems;
*) lte – fix the subscriber number not updating after switching SIM slots;
*) lte – improve system stability when using Quectel EP06-E MBIM modem;
*) lte – improve system stability with eSIM-capable MBIM modems;
*) lte – remove leftover APN slave interfaces when the master LTE interface is removed;
*) lte – use also the network reported ipv6 MTU on MBIM interfaces when “auto” mtu option used;
*) lte – use RA for IPv6 acquisition for FG621;
*) netinstall – add branding-and-custom-packages parameter for custom NPK packages;
*) netinstall – fix a duplicate device entry on RB2011 with SFP;
*) netinstall – fix adding and exporting server comments;
*) netinstall – fix multiple active interfaces inheriting the first interface’s settings;
*) netinstall – fix Netinstall failing to reinstall RB850Gx2 devices;
*) netinstall – fix Netinstaller’s memory check failing downloads to disk;
*) ospf – fix DR/BDR traffic not being received with multiple instances;
*) ospf – improve stability when a neighbor is lost;
*) ovpn – improve stability in UDP mode when the TX queue is full;
*) pim – add MLD support for PIM;
*) pim – fix duplicate PIM configuration parameters;
*) pim – fix PIM-SM issues with IPv6;
*) pim – fix wrong or missing PIM configuration by separating PIM and GMP per interface;
*) poe-out – add port-type field to poe monitor and print output;
*) poe-out – firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out – firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces);
*) poe-out – fix PoE fault led behavior;
*) poe-out – fix PoE ports entering overload state when a PSU is fed from a UPS;
*) poe-out – remove the class limit for LLDP power requests on forced ports;
*) port – accumulate incoming data in log file even without TCP clients connected;
*) port – add an FTDI latency_timer option for low-latency serial applications;
*) ppp – add port interface info to PPP outbound channel defaults;
*) ppp – fix a packet leak during dial-on-demand connection of a ppp-out interface;
*) ppp – fix BG77 modem port name and channel count;
*) ppp – fix the offline firmware-update notification for BG77/BG770 modems;
*) ppp – fix the SINR value reported for BG77 and BG770 modems;
*) ptp – add support for fixed master and slave port roles;
*) ptp – add transparent clock mode;
*) ptp – fix dropped packets on bridges with IGMP snooping and add vlan-id port setting;
*) qos – fix PFC and lossless buffer issues (introduced in v7.23);
*) queue – fix a typo in the cake-overhead-scheme parameter value;
*) route – improve static route handling performance;
*) routing-filter – fix any-regexp community matcher matching an empty community attribute;
*) routing-filter – fix community delete, filter and modify with regexp-only community lists;
*) sfp – fix QSFP28 optical modules failing to establish a link on CCR2216 and CRS520;
*) sfp – improve QSFP-DD link establishing to NVIDIA DGX Spark and other devices;
*) sniffer – improve packet time resolution;
*) snmp – add an OID and logging for blacklisted program access;
*) snmp – add CAPsMAN radio data to SNMP;
*) snmp – add dynamic SNMP engine ID assignment;
*) snmp – add interface table with mtu and l2mtu OIDs;
*) snmp – add IP pool OIDs;
*) snmp – add IPv6 address and interface name to the MNDP neighbour table;
*) snmp – add OID blacklisting;
*) snmp – add OIDs for Netwatch probes;
*) snmp – add OSPF MIB tables;
*) snmp – add ospfAdminStat and ospfRouterId to the OSPF MIB;
*) snmp – add SHA-2 authentication for SNMPv3;
*) snmp – add transmit drop counters;
*) snmp – add VRRP status OIDs for monitoring;
*) snmp – fix the reported capability flags in LLDP-MIB;
*) snmp – fix the snmp tools timing out when authentication is used;
*) snmp – log a warning when the src-address family does not match the request;
*) snmp – remove an interface OID that should not be accessible;
*) ssh – add a connection id to SSH log entries;
*) ssh – add host key verification for the SSH client;
*) ssh – limit server output to the client’s window size;
*) ssh – show router host key fingerprint;
*) ssh – switch the default host key type to Ed25519;
*) ssh – warn users when weak RSA key is being used;
*) ssl – enabled hardware accelerated GCM on Alpine CPUs;
*) ssl – improve logging;
*) switch – add packet and byte counters for ACL rules on Marvell Prestera switches;
*) switch – fix degraded slow-path throughput on CRS304 switch (introduced in v7.22);
*) switch – fix VLAN-tagged traffic being looped back in MLAG setups on CRS8xx series switches;
*) system – fix the frequency units from Mhz to MHz;
*) system – improve stability (includes CVE-2026-31431, CVE-2026-67280);
*) system – reboot automatically when the boot process fails to start;
*) system – reduce the fan control interval on multi-core boards;
*) system – remove the channel label from the RouterOS version;
*) system – show health settings and overtemp options based on device capabilities;
*) system – warn about a missing wifi driver package on BE boards;
*) tftp – add VRF support;
*) traffic-flow – fix a kernel failure when disabling traffic flow on a busy system;
*) user – fix removal of inactive REST API sessions (introduced in 7.21);
*) userman – improve stability when importing database files;
*) vlan – add a forced-mac-address option for VLAN interfaces;
*) vlan – warn when a VLAN interface is created on a slave interface;
*) webfig – add a generic table and union group support;
*) webfig – add column resizing to embedded tables;
*) webfig – hide the left menu only on QuickSet and Terminal pages;
*) webfig – improve comboboxes to select the first matching option while typing;
*) webfig – update style;
*) webfig – update the login page Help link;
*) wifi – add a stream-port argument to configure the sniffer streaming server port;
*) wifi – add fast transition support for MLD devices;
*) wifi – add interworking, aaa and steering settings to the network configuration;
*) wifi – add more steering debug logs;
*) wifi – add network ‘labels’ parameter to WinBox and WebFig;
*) wifi – do not preserve branding package on cap when upgrading via capsman;
*) wifi – fix CAPsMAN failing when mangle marking is used with encrypted data channels;
*) wifi – fix channel reselect interval/time operation for wifi-qcom-be and wifi-mediatek interfaces;
*) wifi – fix incorrect scan results for 320 MHz access points;
*) wifi – fix MLD link type change and SA query in station mode;
*) wifi – fix per-link client statistics for MLO connections;
*) wifi – fix SAE authentication using a wrong cached PMK;
*) wifi – fix station statistics not updating after switching MLD links;
*) wifi – fix the interworking network type;
*) wifi – fix the wrong band shown in the registration table;
*) wifi – fix traffic processing on CAPsMAN after an interface is disabled;
*) wifi – perform a channel switch instead of dropping clients on radar detection;
*) wifi – preserve dude package on cap when upgrading via capsman;
*) wifi – report channel in log messages;
*) wifi – report management frame protection (MFP) usage in registration-table;
*) wifi – reuse freed station association IDs;
*) wifi – show the EAP user identity in the registration table;
*) wifi – show the MLD links and SSID in MLO client log messages;
*) wifi-mediatek – fix 4.9 GHz band operation on the A42;
*) wifi-mediatek – fix roaming between APs belonging to the same MLO group;
*) wifi-mediatek – fix the 5 GHz access point failing to start after reconfiguration on the A42;
*) wifi-mediatek – improve MLO client reconnection;
*) wifi-qcom – fix disconnects during fast transition roaming;
*) wifi-qcom – fix station mode association failures;
*) wifi-qcom – improve IP multicast delivery to wireless clients;
*) wifi-qcom-ac – fix a regression in station MAC address handling;
*) wifi-qcom-ac – reduce package size;
*) wifi-qcom-be – add hw-protection-mode support;
*) wifi-qcom-be – add the distance setting for 802.11be devices;
*) wifi-qcom-be – fix the block ack request being declined after a channel switch;
*) wifi-qcom-be – fix Wi-Fi intermittently unavailable after reboot;
*) wifi-qcom-be – improve throughput in dense client environments;
*) winbox – add a filtered LLDP tab to neighbor discovery;
*) winbox – add a Security tab and reorganize bridge and port dialogs;
*) winbox – add a wifi radio regulatory info (reg-info) view;
*) winbox – add device-mode configuration;
*) winbox – add ISIS support;
*) winbox – add progress bar support to the GUI;
*) winbox – add the client MTU option for WireGuard peers;
*) winbox – add the container save option;
*) winbox – add wifi Spectral Scan support;
*) winbox – allow power-cycling multiple interfaces at once;
*) winbox – allow tuple fields with more than two values and multiple separators;
*) winbox – fix bridge filter window disabling valid fields for IPv6 rules;
*) winbox – fix SFP optical power values of 0.0 dBm not being shown;
*) winbox – fix the channel.reselect-interval range field in CAPsMAN;
*) winbox – fix the EC/IO signal quality graph;
*) winbox – fix the ISIS neighbor level type being empty for “l2”;
*) winbox – fix the Memory Limit field of fq_codel to use bytes;
*) winbox – fix the Min Prefix field in the routing rule dialog;
*) winbox – fix the MPLS TE tunnel path hops field;
*) winbox – fix the range field displayed in route filters;
*) winbox – fix the signal indication graphs for ppp-out interfaces;
*) winbox – fix the Skins menu for user groups opening a non-existent window;
*) winbox – fix the system note display on startup;
*) winbox – fix the wifi Authentication Types and Encryption fields;
*) winbox – fix wg-import creating a WireGuard interface without a config file;
*) winbox – improve status reporting under Tools/Email menu;
*) winbox – make the Power Cycle button act only on the selected interface;
*) winbox – open the Format Drive panel only for supported disks;
*) winbox – remove the redundant empty status field from the License window;
*) winbox – rename “send” to “transmit” in the Bandwidth Test window;
*) winbox – rework the switch QoS statistics table;
*) winbox – set minimal supported WinBox version to 4.3;
*) winbox – show warning messages under “System/Users/SSH Keys” and “System/Users/SSH Private Keys” menu;
*) winbox – show WireGuard peer information;
*) wireguard – add the client-mtu parameter;
*) wireguard – allow referencing a peer by its name;
*) wireguard – allow unsetting the client-listen-port;
*) wireguard – fix a peer that would not work after import when no endpoint address is set;
*) wireguard – improve error message reporting when adding a new peer;
*) wireguard – keep peer rx/tx counters when the peer is disabled and enabled;
*) wireguard – support comment lines in wg-import configuration files;
*) wireguard – treat empty private-key and preshared-key values as none;
*) wireguard – use the MTU value when importing a configuration;
*) wireguard – warn when an allowed-address overlaps another peer;
*) www – add the remote client IP and domain to HTTPS log messages;
*) www – fix a memory leak when parsing authentication headers;
*) www – improve URI parsing;

Download direttamente dal sito Mikrotik https://mikrotik.com/download