Important security update

normis · September 4, 2026, 7:58am

MikroTik has found a security vulnerability in RouterOS and releases containing a fix have been published in all channels.

This is an important security update. Most configurations are not at risk, but upgrading is highly recommended.

To give time to update your systems, we are not currently publishing detailed information.

Your device should already give you the option to upgrade software in the "Check for updates" menu.

Fix is included in:

7.25 beta 3
7.24.2
7.23.4
6.49.21

and newer.

For regular home device users and default configurations, the issue does not pose an immediate risk, but we still suggest all users to upgrade.

Steps after upgrade

RouterOS will check if your device has been compromised, and set it to "Flagged" status if it is. This will be written in the "Log" section. If your log has a critical entry saying your device has been Flagged, please follow the instructions in the Flagged status documentation page

Even if your device is not in Flagged state, after upgrading your RouterOS, inspect your device configuration for any unknown scripts, users or other config you do not recognise. This is suggested in any case, Flagged or not. Flagged status does not delete configuration, you should still inspect it.

This article will be updated with more information in due time.

ppslim · September 4, 2026, 10:03am

In changelogs, 7.24, 7.24.1 & 7.24.2 are all marked as testing, and all th same except 7.24.2 are marked as development.

Is this intentional?

I am most nervous about 7.24.2 being marked testing.

Jotne · September 4, 2026, 10:03am

Is it possible to get a clue on what make you vulnerable ?
Not all are able to upgrade all routers.

Some router can not be taken down (or just at some time date)
Some are remote and only possible to upgrade by physically visit them

+++

normis · September 4, 2026, 10:04am

what do you mean? where is it marked as testing?

normis · September 4, 2026, 10:06am

Every minute you delay upgrade, is more risk for compromise.

All I can reveal in this moment is that administrative access ports should be protected from untrusted networks (internet), and segmented in separate VLAN in large internal networks. Do not expose Winbox, Webfig, SSH to internet, use a firewall and access your device with a strong VPN like Wireguard.

Do this if you can't upgrade.

ppslim · September 4, 2026, 10:07am

normis · September 4, 2026, 10:08am

That is some kind of homepage bug. We will fix it.

7.24.2 is STABLE

eider · September 4, 2026, 10:11am

On forums too, it seems

normis · September 4, 2026, 10:14am

Copy paste mistake. All versions were released on same day. Will fix there too.

infabo · September 4, 2026, 10:22am

Yeah, @EdPa usually doing the announcements.

petrb · September 4, 2026, 12:11pm

Does help use of "/ip service set ssh address=xxxx" to improve security or only firewall stop this?

dvm · September 4, 2026, 12:56pm

Why not use both of them? And strong-crypto=yes.

toxi · September 4, 2026, 1:01pm

The firewall is in effect even before the packet arrives at the SSH server.
And SSH IP restriction works at the application level. That is, the packet has already passed the firewall and reached the SSH service.

I would recommend implementing restrictions in the firewall so that later, years from now, you don't have to search for other IP address restrictions.

petrb · September 4, 2026, 1:03pm

Because ip firewall is in collision with fastpath (that is used) - it is inside internal network (try to improve security). Strong-crypto is set.

I know. That's why I asking if this restriction works.

Kindis · September 4, 2026, 1:05pm

No webpage is correct. This build is served to the testing channel as well and I think this is great. If we did not feed this channel with this build they would be stuck in a insecure 7.23 build so I think webpage is correct. It does not mean that the build is testing it means 7.24.2 is rolling out to Stable and Testing channels which is very good!

Edit: @normis I hope you have cooling fans for your keyboard based on forum activity Hope you all at MT can have a realxed weekend as I suspect week was stressed and no fun!

ewysong · September 4, 2026, 1:19pm

@normis I've reviewed https://mikrotik.com/supportsec/september-2026-vulnerability/ but would like some additional clarification on affected versions if you could please. Can you confirm if all 7.X.X versions below the patched 7.23.4 version are vulnerable? 7.20.8 and 7.21.5 are listed on the Downloads page as "Long-term", but there are not patches for them. Does that mean they are not vulnerable, or just not being patched? That would be good to indicate on the above linked vulnerability page as it's unclear whether those long term releases are affected or not.

normis · September 4, 2026, 1:20pm

It's hard to say "all" since MikroTik makes RouterOS for 30 years, but ... yes, many years of versions affected. Fix is only since the mentioned releases.

dvm · September 4, 2026, 1:28pm

You can send such traffic to FastTrack with suitable Forward rule, so it will not interfere with FastPath.

petrb · September 4, 2026, 1:48pm

I already know this. The goal is to relieve the CPU as much as possible. I know the solution, but /ip service address configuration is what interests me.