7.25.1 [stable] is released!

Before an upgrade:

  1. Remember to make backup/export files before an upgrade and save them on another storage device;
  2. Make sure the device will not lose power during upgrade process;
  3. Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 7.25.1 (2026-11-02):

  • bridge - fix BPDUs leaking to the wrong dual-connected bond in MLAG (introduced in v7.24);
  • bridge - improve FDB synchronization between MLAG peers when VLANs are added;
  • console - fix custom SSH client login parameters being ignored (introduced in v7.25);
  • dhcpv4-client - fix packet length calculation (introduced in v7.25);
  • dude - fix missing outage times and graph background scaling (introduced in v7.25);
  • fetch - fix HTTP fetch getting stuck in a "bad HTTP response" state;
  • ipsec - fix XFRM interfaces staying down until a reboot;
  • ipv6 - fix from-pool address lifetimes not updating after a prefix renewal (introduced in v7.25);
  • pim - fix IGMP/MLD querier being disabled after upgrade (introduced in v7.25);
  • ptp - fix PTP support on CRS804-4DDQ;
  • routing-filter - fix host matching in address lists with more than 64 ranges;
  • sfp - fix DAC EEPROM corruption when disabling 400G ports on CRS804 and CRS812 switches;
  • ssh - fix packet alignment when SHA-1 is used (introduced in v7.25);
  • system - improve stability (includes CVE-2026-98432);
  • webfig - fix multi-value fields being displayed as empty (introduced in v7.25);
  • wifi - fix virtual interface restart loop when reselect-interval and reselect-time are configured (introduced in v7.25);

To upgrade, click Check For Updates under System/Packages menu and select the stable Channel in RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

  • Everything went smoothly
  • I encountered an issue after the update (please post about the device, configuration, and unexpected symptoms)
  • I encountered an issue, but solved it (please post the solution)
0 voters

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. The file must be generated while a router is not working as suspected or after some problem has appeared on the device

Please keep this forum topic strictly related to this particular RouterOS release.

Nice! This release probably fixes all or most bugs reported in 7.25.

hap be lite. wifi is not working. devices can't connect. nothing has changed after upgrading from 7.25 to 7.25.1

I'm back on 7.24.6

I just updated few Hap lites and had no problems with it.

Was I the only one expecting the continuous writing issue to be resolved?

hap be lite or hap lite? These are two different products.

hap lite. Not the new be one. Also updated 2x rb3001, CRS326-24g. CRS305 and hap ax. All went fine so far.

Thanks for addressing the major issues quickly. Bonus point for mentioning the CVE with the system stability item.

I would have thought there would be more fixes than that.

MikroTik hAP ax² working fine.

rb5009upr, 2x cap ax and a crs310-8g+2s upgraded and working without issues.

My hap be lite getting Capsman from RB5009 was fine on 7.25 and also fine on 7.25.1.

RB5009, CRS310, hap be lite, hap be3 media all upgraded without any issues (other than the CRS310 takes ages to reboot to the point of making me feel twitchy that something bad has happened)

In /export, the /ip route section gets split in two halves!

The /ipv6 address and the /interface list member as well.

Depending what you need from it, switch the crs310 to switchOS its gonna reboot/boot in literal seconds, if u dont need l3hw, swOS would suffice and its way less demanding + it boots in a reasonable time.

Show me which settings for hap be lite you use.
I tried using hap be lite with capsman and as an independent point. in all variants, the devices are not connected.

After upgrading the router CCR2004-1G-12S+2XS to RouterOS 7.25.1 and then updating RouterBOOT, the device did not boot. All LEDs were lit, and the fan was running at maximum speed. It only came back up after I manually power-cycled it (unplugged and reconnected the power).

More than 50% of errors comes from previous version. Maybe there should be some more tests. (9 out of 16 in the change log)

Thanks, I'll look into that option for the future! :slight_smile:

Here's my full slightly redacted Hap be Lite config which was running fine on 7.25 and continues to run fine on 7.25.1. I'd PM it rather than post it here, but this forum doesn't appear to have PMs.

Capsman is running on an RB5009. It has my vlan config in it, primarily for the wired ports, and has an emergency access off bridge port configured in case of vlan messups. If you have Capsman in the lan, you should be able to boot the Hap into cap mode using "Keep holding the reset button until the LED turns solid, then release it to enable CAP mode. The device will then start searching for a CAPsMAN server." which will load the CAP default config.

# 2026-11-03 13:32:47 by RouterOS 7.25.1
# software id = LD3J-6A3V
#
# model = A42G-HbeP
# serial number = REDACTED
/interface list
add comment="Management only" name=MGMT
add comment=defconf name=WAN
add comment=defconf name=LAN
add comment="Management and LAN" include=LAN,MGMT name=MGMTandLAN
/ip neighbor discovery-settings
set discover-interface-list=MGMTandLAN
/ipv6 settings
set disable-ipv6=yes
/ip dhcp-server network
add address=192.168.99.0/24 dns-server=192.168.99.1 gateway=192.168.99.1
/ip pool
add name=Offbridge-dhcp-pool ranges=192.168.99.100-192.168.99.254
/ip ssh
set host-key-type=rsa known-hosts-validation=no
/interface bridge
add admin-mac=redacted auto-mac=no comment=defconf name=bridgeLocal \
    vlan-filtering=yes
/interface vlan
add comment=Infrastructure interface=bridgeLocal name=bridge.vlan10 vlan-id=\
    10
add comment=Clients interface=bridgeLocal name=bridge.vlan20 vlan-id=20
add comment=Cameras interface=bridgeLocal name=bridge.vlan30 vlan-id=30
add comment=IOT interface=bridgeLocal name=bridge.vlan40 vlan-id=40
add comment=Oubliette interface=bridgeLocal name=bridge.vlan50 vlan-id=50
add comment=Management interface=bridgeLocal name=bridge.vlan99 vlan-id=99
/interface list member
add comment=defconf interface=bridgeLocal list=LAN
add comment=OffBridge interface=ether4 list=MGMT
add interface=bridge.vlan20 list=LAN
add interface=bridge.vlan10 list=LAN
add interface=bridge.vlan99 list=MGMT
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi cap
set caps-man-addresses=192.168.10.1 discovery-interfaces=bridge.vlan10 \
    enabled=yes slaves-datapath=capdp slaves-static=no
/ip address
add address=192.168.99.1/24 interface=ether4 network=192.168.99.0
add address=192.168.10.3/24 interface=bridge.vlan10 network=192.168.10.0
/ip dhcp-client
add interface=bridge.vlan10 name=dhcp.vlan10
add interface=bridge.vlan20 name=dhcp.vlan20
add interface=bridge.vlan30 name=dhcp.vlan30
add interface=bridge.vlan40 name=dhcp.vlan40
add interface=bridgeLocal name=client1
/ip dhcp-server
# Interface not running
add address-pool=Offbridge-dhcp-pool interface=ether4 name=\
    Offbridge-dhcp-server
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=input comment=\
    "modconf: allow from MGMT interface ether4" in-interface-list=MGMT
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.10.1
/system clock
set time-zone-name=Europe/London
/system identity
set name="hAP be lite"
/tool mac-server
set allowed-interface-list=MGMTandLAN
/tool mac-server mac-winbox
set allowed-interface-list=MGMTandLAN
/interface wifi
# managed by CAPsMAN REDACTED%bridge.vlan10, traffic processing on CAP
# mode: AP, SSID: REDACTED, channel: 2472/be/eC
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=capdp \
    datapath.vlan-id=10 disabled=no
# managed by CAPsMAN REDACTED%bridge.vlan10, traffic processing on CAP
# mode: AP, SSID: REDACTED, channel: 5320/be/eeeeeeeC/DI
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=capdp \
    datapath.vlan-id=10 disabled=no
/interface bridge port
add bridge=bridgeLocal comment=defconf frame-types=admit-only-vlan-tagged \
    interface=ether1
add bridge=bridgeLocal comment=defconf frame-types=admit-only-vlan-tagged \
    interface=ether2
add bridge=bridgeLocal comment=defconf frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether3 pvid=50
/interface bridge vlan
add bridge=bridgeLocal comment=Cameras tagged=ether1,ether2 vlan-ids=30
add bridge=bridgeLocal comment=Infrastructure tagged=ether1,ether2 vlan-ids=\
    10
add bridge=bridgeLocal comment=Clients tagged=ether1,ether2 vlan-ids=20
add bridge=bridgeLocal comment=Management tagged=ether1,ether2 vlan-ids=99
add bridge=bridgeLocal comment=IOT tagged=ether1,ether2 vlan-ids=40
add bridge=bridgeLocal comment=Oubliette tagged=ether1 vlan-ids=50

IPv6 quirk:
The Valid and Preferred lifetimes for the DHCPv6 IA_NA address are counting up instead of displaying "forever".