6.49.21 [long-term] is released!

Announcements
1

Before an upgrade:

  1. Remember to make backup/export files before an upgrade and save them on another storage device;
  2. Make sure the device will not lose power during upgrade process;
  3. Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 6.49.21 (2026-09-03):

This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information.

  • btest - improve stability;
  • console - improve stability;
  • fetch - improve stability of the TFTP client;
  • snmp - improve stability of SNMP;
  • ssh - refactor SSH internal processes and improved system stability;
  • system - improve stability;
  • system - updated certificate for Windows executable signing;
  • timezone - updated timezone information from "tzdata2026b" release;

To upgrade, click Check For Updates under System/Packages menu and select the stable Channel in RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

  • Everything went smoothly
  • I encountered an issue after the update (please post about the device, configuration, and unexpected symptoms)
  • I encountered an issue, but solved it (please post the solution)
0 voters

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. The file must be generated while a router is not working as suspected or after some problem has appeared on the device

Please keep this forum topic strictly related to this particular RouterOS release.

2

Please note, we are no longer actively working on the v6 branch and it might contain more undiscovered issues. v7 is truly much more hardened in ways that are impossible to do in v6.

Do upgrade to v7 to stay safe.

3

Thanks, is clear, of course.

But nothing already know, right?

4

My little "hAP lite" did not run stable on v7. :sob:

5

I presume if you cut off device internet access you would be pretty safe with ROS 6 in foreseeable future... although one should keep in mind that ROS 6 is using old wireless package that could pose some risk regardless of this newest and obscured one...

6

Pleas pin and unpin 6.49.20

7

Mikrotik routeros 6.49.21 started misbehaving after upgrade from 6.49.20.
The device acts as L2TP/IPSEC server.
Incoming connections fail to establish, l2tp server silently drops the tunnel after auth.

The device is not flagged according to /system device-mode output.
[admin@RouterOS] > /system device-mode print
mode: enterprise
Upd: setting device-mode flagged=no explicitly resolved the issue.

8

What I like in ROS 6 is the ability to disable some packages contained in RouterOS bundle, like ppp or hotspot, if I dont need them and to reduce attack possibilities.
Even better solution would be the ability to disable and immediately shutdown and restart any specific services not only for security reasons but also if it hangs for any reason... maybe something to consider in the future...

9

Most unlikely - there is no ongoing development to v6, only critical security bugfixes

10

What I meant was to implement in V7, or some futrue version like V8...

11

Disable these features in device-mode.

12

Thanks, this helped me. After the update, my GRE tunnels between two RB4011s stayed down.

13

It is pretty inconvenient and hardly instantaneous or without interruption since it requires power off or device reset...

14

Disabling packages in v6 did also require a reboot IIRC.

15

Yes but not pressing reset or powering of as in V7...
On the other hand I said that even better solution would be to simply enable starting or stopping services as in most other routers...

16

We have a number of devices still running v6, after upgrading some RB3011 from 6.49.20 to 6.49.21 OpenVPN connections fail to re-establish.

For Mikrotik client to Mikrotik server connections the server has repeated log entries of 'TCP connection established from x.x.x.x' which are followed by ': using encoding - 'AES-128-CBC/SHA1'

For third-party client to Mikrotik server the server has repeated log entries of 'TCP connection established from x.x.x.x' which are followed by 'duplicate packet, dropping' with a huge list of topics 'ovpn,debug,error,l2tp,unknown,unknown,unknown,unknown,unknown,l2tp,info,unknown, debug'

17

Hey!

I have a question regarding how to check if the device has been compromised after upgrading.

According to the documentation provided by MikroTik regarding the vulnerability, flagged value under device-mode should be false after making the upgrade (unless the device has been compromised).

However, on a router running the v6 branch, specifically RouterOS v6.49.21, I get the following output:

[user@configtest-v6] > /system device-mode print
  mode: enterprise
[user@configtest-v6] >

As you can see, there is no reference to flagged (or flagging-enabled) in the output.The corresponding parameters do exist in the CLI and configuration menus, but they return nil (see the following ouput):

[user@configtest-v6] > :put [system device-mode get flagged]

[user@configtest-v6] > :put [system device-mode get flagging-enabled]

[user@configtest-v6] > :put [:typeof [system device-mode get flagging-enabled]]
nil

[user@configtest-v6] > :put [:typeof [system device-mode get flagged]]
nil

Is this expected behaviour on RouterOS v6 branch? If so, what is the correct way to check the flagged status on RouterOS v6?

Thanks for your time!

19

When the device has exposed ssh, webfig or winbox to internet, assume it has been compromised.

The device-mode is a v7 feature, but also it is only for positive indication of compromise, not for negative.

20

Any ".5" fix on this version?

21

Version 6.49.22 has been released: