Is it possible to update RouterOS to a specifiy version over CLI? So not the newest, but e.g. 6.40?
I'm using MikroTik CCR1009-7G-Version.

Download particular version of ROS you want to install from https://mikrotik.com/download ... extract .npk files you need (check list of currentlyinstalled packages) and manually upload them to your CCR. If version of packages you uploaded is newer than ROS installed on device, just reboot device. If you actually want to downgrade (packages are older version than current ROS on device), you have to instruct ROS to downgrade (/system package downgrade).

Note that it is not possible to downgrade below the RouterOS version that came with the device.
Look in system->resources, at the bottom it says "factory software". That is the lowest version you can install.

Of course it is not advisable to run software that old. It has vulnerabilities.

Thank you both very much.

Since we are provisioning a lot of CCRs, we use a shell-script. I think it should be possible to implement a corresponding logic.

When you have a lot of CCRs, I don't recommend standardising on an older version. When you buy new ones, they will not be able to run the older version.
Running an older version would usually be motivated by the changes in the bridge/switch, and it does not apply to the CCR1009-7G anyway.

When you have a lot of CCRs, I don't recommend standardising on an older version. When you buy new ones, they will not be able to run the older version.
Running an older version would usually be motivated by the changes in the bridge/switch, and it does not apply to the CCR1009-7G anyway.

That was exactly the reason why we decided on a standardized RouterOS version. At some point the differences became so big that customizations were no longer possible.

Updates are very difficult to do because they have to be scheduled with customers. But I see what you mean. We will see if this becomes a problem. There is probably no perfect solution.

When you have CCR1009-7G (and not 8G) you are not affected by the changes in the bridge/switch architecture (master-port to bridge migration) so that does not affect you. Maybe you have seen it happen in other MikroTik devices.
Another recent change is in the IPsec configuration, but that would not warrant to use such an old version. The 6.43 version would be suitable. At least that is still available as long-term version so you will get security updates.
The older versions are definately unsafe to run when third party (your customers, the internet) have access to the router configuration ports. So you would have to have these in a separate management network. Of course that is always advisable, but in this case it is mandatory.
(someone with access to the winbox port can download your user/password in plaintext when you run unpatched versions)

In general is is probably not workable to keep all your customers on the same version.