!) security - fixed vulnerabilities CVE-2018-1157, CVE-2018-1158;

!) security - fixed vulnerabilities CVE-2019-11477, CVE-2019-11478, CVE-2019-11479;
!) security - fixed vulnerability CVE-2019-13074;
!) user - removed insecure password storage;
*) conntrack - fixed GRE protocol packet connection-state matching (CVE-2014-8160);
*) ovpn - added "verify-server-certificate" parameter for OVPN client (CVE-2018-10066);
*) www - improved client-initiated renegotiation within the SSL and TLS protocols (CVE-2011-1473);

i upgrade my RB433AH after that...i couldn't access with current user and password and with admin????

i upgrade my RB433AH after that...i couldn't access with current user and password and with admin????

.
My observation is that after a reboot, the first login attempt fails ... subsequent logins are successful. This behavior has been reproducible after every reboot, of the single device I'm testing on (hAP Lite).

!) security - fixed vulnerabilities CVE-2018-1157, CVE-2018-1158;

Fixed again?

!) security - fixed vulnerabilities CVE-2018-1157, CVE-2018-1158;

Fixed again?

Both CVE's were fixed in the previous versions, but they could be reproduced differently if you had access to the www service and user account with "full" rights. We have removed this possibility as well.

and how can we get access?

and how can we get access?

You can't That is the point of this issue. Only the admin himself could trigger the problem. it's not a serious issue, but we still fixed it.

and how can we get access?

You can't That is the point of this issue. Only the admin himself could trigger the problem. it's not a serious issue, but we still fixed it.

So we have to replace the router? so fany

GRE tunnels won't start anymore between 6.45.1 versions. But 6.44.3 <--> 6.45.1 are working fine.

Is this just GRE or GRE over IPSec? Possibly an IPSec issue?

After upgrade map receive "ERROR: wrong username or password" when connect with winbox. But connect with webfig, ssh without errors. Clear winbox cache don't helped.

Connect through Winbox again and the second time should already log in normally.
I only have 2 routers so it was, clicked Connect and logged in to the router

After upgrade map receive "ERROR: wrong username or password" when connect with winbox. But connect with webfig, ssh without errors. Clear winbox cache don't helped.

GRE tunnels won't start anymore between 6.45.1 versions. But 6.44.3 <--> 6.45.1 are working fine.

Is this just GRE or GRE over IPSec? Possibly an IPSec issue?

me to, but i have problem on api, i can connect with winbox, but i can't login with API ( wrong password ). why?

After upgrade map receive "ERROR: wrong username or password" when connect with winbox. But connect with webfig, ssh without errors. Clear winbox cache don't helped.

2 Mikrotik Team

Do you confirm some troubles with GRE interfaces + IPSec (transport) ?
What we have to do in that case?

Maybe there is something special with update? For example: We have to update passive sites first to 6.45.1 and after main router to 6.45.1
Or another way?

Thanks!

I have IPsec tunnels between 6.45.1 and various 6.4X versions and also all the way back to 5.26.
All IPsec tunnels work without any issues on all versions I have atm.
The only issue I had was that some statically defined policies, lost their peer association after the update. By selecting the correct one, the IPsec sessions established fine.

My configurations use all types of tunnels.

GRE, IPIP, EoIP. All of them, over IPsec without any problems on my end.

My configurations use all types of tunnels.

GRE, IPIP, EoIP. All of them, over IPsec without any problems on my end.

My configurations use all types of tunnels.

GRE, IPIP, EoIP. All of them, over IPsec without any problems on my end.

Thanks, will try to find out, what's wrong with my situation.

On another remote router (mipsbe + wireless) - nothing -> no gre in Connection tracker with 6.45.1. > Tunnels DOWN

Try to update 6.45.1 remote sites
On some remote router (mipsbe w|o wireless) on 6.45.1 i see 47 gre in Connection tracker > Tunnes UP

me to, but i have problem on api, i can connect with winbox, but i can't login with API ( wrong password ). why?

Do you use new login style in API?
https://wiki.mikrotik.com/wiki/Manual:API#Initial_login

Try to update 6.45.1 remote sites
On some remote router (mipsbe w|o wireless) on 6.45.1 i see 47 gre in Connection tracker > Tunnes UP

UPDATE:
NOW Checked Connection tracker - Tunnels UP - NO GRE 47 protocol in Connection Tracker!
Downgrade last failed router.

one hap lite wont upgrade. I suspect space problem.

one hap lite wont upgrade. I suspect space problem.

I confirm. upgrade problem on hap lite.

one hap lite wont upgrade. I suspect space problem, but there are no files on the system.

Hi
upgraded crs326 and one hap lite without issues : 6.43.3 --> 6.45.1
one hap lite wont upgrade. I suspect space problem, but there are no files on the system.

After swtiching from 6.43.16 to 6.54.1 I am not able to use my LTE connection. My main router (RB2011) is getting an IP from BaseBox2 + R11e-LTE (passthorugh, using only Band 3, T-Mobile Poland). Modem shows status connected and everything seems to be OK. However, there is no traffic coming through LTE modem. I have upgraded Routerbord too and it hasn't helped. After coming back to 6.43.16 it works fine again.

After coming back to 6.43.16 it works fine again.

Upgraded RB4011 from 6.44.3 to 6.45.1 - no issues

After coming back to 6.43.16 it works fine again.

v6.43.16 is using P2P ip configuration for LTE passthrough. 6.45 is using small ip block, back as it was in pre-6.43.
check what ip you get and if you can ping the gateway at least.

Hi All,

For those having trouble with EoIP/GRE following the upgrade the below workaround worked for me:

Code: Select all

/ip firewall raw add action=notrack chain=prerouting protocol=gre

Hi All,

For those having trouble with EoIP/GRE following the upgrade the below workaround worked for me:

Code: Select all

/ip firewall raw add action=notrack chain=prerouting protocol=gre

Has anyone solved these password issues as yet to access the routers ?

We have one remote router which is in a different country. We have a STTP VPN direct to the router which is showing as connected but the username and password are not working - It was working fine before it was upgraded.

It has or at least had a 16 digit random password on it with a custom username.

Tried using the username without a password
Tried the admin account with no password
Tried asking a staff member to reboot it

Still no access and we're not really sure what to try next - Any help much appreciated

Has anyone solved these password issues as yet to access the routers ?

We have one remote router which is in a different country. We have a STTP VPN direct to the router which is showing as connected but the username and password are not working - It was working fine before it was upgraded.

It has or at least had a 16 digit random password on it with a custom username.

Tried using the username without a password
Tried the admin account with no password
Tried asking a staff member to reboot it

Still no access and we're not really sure what to try next - Any help much appreciated

I have the same problem, see post #55. I have not found a workaround.

Sent from my Pixel 3 using Tapatalk

me to, but i have problem on api, i can connect with winbox, but i can't login with API ( wrong password ). why?

Do you use new login style in API?
https://wiki.mikrotik.com/wiki/Manual:API#Initial_login

me to, but i have problem on api, i can connect with winbox, but i can't login with API ( wrong password ). why?

Do you use new login style in API?
https://wiki.mikrotik.com/wiki/Manual:API#Initial_login

!) ike2 - added support for EAP authentication methods (eap-tls, eap-ttls, eap-peap, eap-mschapv2) as initiator;

Hello I have a Router RB 750 and when I tried to update from winbox or donwloading the file from mikrotik
after I rebot, I get this message:

" system,error can not install routeros-mipsbe-6.45.1: it is not made for m
mips, but for mips "

Some know what to do?

raystream, nichky, LetMeRepair, proximus, Cha0s, 3bs, Vlad2, sterod, mserge, STEVEUK1, elgrandiegote - We can not seem to reproduce the problem with Winbox login. Can you provide more details? From which version did you upgrade your router? Do you, for example, use RADIUS for Winbox authorisation?

SimWhite, nuffrespect, w0lt, snake27, Hyperlight - Please try to add a new firewall rule at every end of the tunnel and see if it starts to work properly? The rule should be located at the top (at least before drop rules) of input firewall filter rules chain (/ip firewall filter add chain=input action=accept protocol=gre src-address=[address that is configured as a remote-address on your GRE tunnel interface]);

3bs - Can you please:

1) Try to log into your router by using Winbox;
2) See that authentication fails;
3) Log into your router by another method;
4) Generate supout file;
5) Download file from the router;
6) Send this file to support@mikrotik.com?

SimWhite, nuffrespect, w0lt, snake27, Hyperlight - Please try to add a new firewall rule at every end of the tunnel and see if it starts to work properly? The rule should be located at the top (at least before drop rules) of input firewall filter rules chain (/ip firewall filter add chain=input action=accept protocol=gre src-address=[address that is configured as a remote-address on your GRE tunnel interface]);

jvparis - Which country have you selected? What happens, if you try to use this command "/interface wireless set [interface_name] country=[your_country] frequency-mode=regulatroy-domain installation=indoor"? What kind of an error do you get?

[admin@sxt-wds] <SAFE> /interface wireless set wlan1 country=germany frequency-mode=regulatory-domain installation=indoor 
failure: allowed installation type is outdoor

raystream, nichky, LetMeRepair, proximus, Cha0s, 3bs, Vlad2, sterod, mserge, STEVEUK1, elgrandiegote - We can not seem to reproduce the problem with Winbox login. Can you provide more details? From which version did you upgrade your router? Do you, for example, use RADIUS for Winbox authorisation?

Upgraded from version 6.44.3, no RADIUS, internal authorisation.

Winbox login problem, please:
winbox 3.18 - tools-clear cache WORK

API login problems, please:
change all script (lms,serwer,PHP...) - are you fu... crazy ? I must change all my programs
90% admins says now : F...

People who have RB932 - check, maybe there is a problem with lack of disk space ?
And sorry for bad English

Upgraded RB4011 from 6.44.3 to 6.45.1 - no issues

Well, actually there is one - the bridge MAC address has changed so the network discovery on Windows must be done again. In my case the bridge MAC addr is the same as for eth7 interface. Interesting what it depends on...
Best
Bam

@strods

I have same MAC adress on SFP+ and WLAN Interface 5G (QCA9984) ..... the 2.4GHz Interface has another MAC Adress.
The SFP+ Port is disabled, so do i need to do any changes/resets ?

regards, Richard

SimWhite, nuffrespect, w0lt, snake27, Hyperlight - Please try to add a new firewall rule at every end of the tunnel and see if it starts to work properly? The rule should be located at the top (at least before drop rules) of input firewall filter rules chain (/ip firewall filter add chain=input action=accept protocol=gre src-address=[address that is configured as a remote-address on your GRE tunnel interface]);

strods, Could you tell is this a bug or a feature? Will it be fixed in the next updates or we should use such kind of rules started from 6.45.1?

!) ike2 - added support for EAP authentication methods (eap-tls, eap-ttls, eap-peap, eap-mschapv2) as initiator;

Since this is "as initiator," can I assume this isn't supported for running as a roadwarrior config?

If so, when is support for that coming, if at all?

Actually bug was the fact that your tunnel did work before.

It looks like Dude has problems with SNMP access.

snmpwalk to other Mikrotik device causes this to appear in log of target device

Code: Select all

10:22:24 snmp,debug unsupported v3 security level 
10:22:24 snmp,debug v3 err: 0 unsupported security
10:22:24 snmp,debug bad packet

and snmpwalk times out. We have LibreNMS set up for monitoring and it works fine as it did before.SNMP is set up as v3 private access.

Dude is updated to 6.45.1. It is hard to say whether Dude is the problem or RouterOS on the device itself...

Everyone who is experiencing problems with Winbox authorization - we will release a new Winbox loader with a fix for this problem as soon as possible. We are very sorry for any inconvenience caused.

SimWhite, nuffrespect, w0lt, snake27, Hyperlight - Please try to add a new firewall rule at every end of the tunnel and see if it starts to work properly? The rule should be located at the top (at least before drop rules) of input firewall filter rules chain (/ip firewall filter add chain=input action=accept protocol=gre src-address=[address that is configured as a remote-address on your GRE tunnel interface]);

API login problems, please:
change all script (lms,serwer,PHP...) - are you fu... crazy ? I must change all my programs
90% admins says now : F...

ludvik - On some specific and very rare case Ethernet interface on TILE routers could lock up. Now this problem is resolved;
ndbjorne, kobuki, smileymattj - Bugfix version (long-term) will be released as soon as possible;
eworm, matiaszon, toxmost, Stanleyssm, wpeople, petrb, lomayani - I recommend that you provide supout file to support@mikrotik.com in order to get more information about the problem that you are experiencing;
pacman88 - CRS3xx switches now can better handle traffic passing through the switch if interface speeds are different;
nmt1900 - Can you reproduce this problem once more? Actually. sounds that this was simply a coincidence and the problem was caused by something else besides static ARP entries;
raystream, nichky, LetMeRepair, proximus, Cha0s, 3bs, Vlad2, sterod, mserge, STEVEUK1, elgrandiegote - We can not seem to reproduce the problem with Winbox login. Can you provide more details? From which version did you upgrade your router? Do you, for example, use RADIUS for Winbox authorisation?
SimWhite, nuffrespect, w0lt, snake27, Hyperlight - Please try to add a new firewall rule at every end of the tunnel and see if it starts to work properly? The rule should be located at the top (at least before drop rules) of input firewall filter rules chain (/ip firewall filter add chain=input action=accept protocol=gre src-address=[address that is configured as a remote-address on your GRE tunnel interface]);
rifkytech, bleblas, marcperea, mducharme, nerxu, jwilkinson6028 - If you cannot login into your router by using API please make sure that you have updated API authentication script (https://wiki.mikrotik.com/wiki/Manual:API#Initial_login);
anav - Is this problem related to RouterOS v6.45.1 or this is simply a configuration related question?
OndrejHolas - We will resolve this problem as soon as possible;
markos222 - Currently fix is available only in v6.45. Fix will be backported to long-term versions aswell;
adonato - MIPS and MMIPS are two differnet architectures. Is it RB750 or RB750Gr3? Please name precise model.

ludvik - On some specific and very rare case Ethernet interface on TILE routers could lock up. Now this problem is resolved;
ndbjorne, kobuki, smileymattj - Bugfix version (long-term) will be released as soon as possible;
eworm, matiaszon, toxmost, Stanleyssm, wpeople, petrb, lomayani - I recommend that you provide supout file to support@mikrotik.com in order to get more information about the problem that you are experiencing;
pacman88 - CRS3xx switches now can better handle traffic passing through the switch if interface speeds are different;
nmt1900 - Can you reproduce this problem once more? Actually. sounds that this was simply a coincidence and the problem was caused by something else besides static ARP entries;
raystream, nichky, LetMeRepair, proximus, Cha0s, 3bs, Vlad2, sterod, mserge, STEVEUK1, elgrandiegote - We can not seem to reproduce the problem with Winbox login. Can you provide more details? From which version did you upgrade your router? Do you, for example, use RADIUS for Winbox authorisation?
SimWhite, nuffrespect, w0lt, snake27, Hyperlight - Please try to add a new firewall rule at every end of the tunnel and see if it starts to work properly? The rule should be located at the top (at least before drop rules) of input firewall filter rules chain (/ip firewall filter add chain=input action=accept protocol=gre src-address=[address that is configured as a remote-address on your GRE tunnel interface]);
rifkytech, bleblas, marcperea, mducharme, nerxu, jwilkinson6028 - If you cannot login into your router by using API please make sure that you have updated API authentication script (https://wiki.mikrotik.com/wiki/Manual:API#Initial_login);
anav - Is this problem related to RouterOS v6.45.1 or this is simply a configuration related question?
OndrejHolas - We will resolve this problem as soon as possible;
markos222 - Currently fix is available only in v6.45. Fix will be backported to long-term versions aswell;
adonato - MIPS and MMIPS are two differnet architectures. Is it RB750 or RB750Gr3? Please name precise model.

Hey. What about low capacity of space in hAP lite? Watever I did, it says not enough space. Every time.

!) ike2 - added support for EAP authentication methods (eap-tls, eap-ttls, eap-peap, eap-mschapv2) as initiator;

Since this is "as initiator," can I assume this isn't supported for running as a roadwarrior config?

If so, when is support for that coming, if at all?

Road warrior client is always an initiator, so I do not see the reason why it shouldn't be supported.

[admin@RB4011] /ip ipsec identity> add peer=ikev2 auth-method=eap eap-methods=eap-tls remote-certificate=ios-client generate-policy=port-strict
failure: only EAP client supported  

As far as I understand you are trying to configure server. Server requires RADIUS server with EAP support. Locally on the router it is not supported.

Everyone who is experiencing problems with Winbox authorization - we will release a new Winbox loader with a fix for this problem as soon as possible. We are very sorry for any inconvenience caused.

It is wrong if initiator is remote router.

Can you be more verbose? "initiator" is a role of an IPsec peer, but there is no "initiator/responder" or "client/server" role related to GRE, both ends of the tunnel are sending no matter whether the remote end responds or not and no matter whether a corresponding IPsec policy is available or not, and no matter what is the role of the IPsec peer used by that policy. As there are no ports in GRE, and as the ID field is the same for all packets, an IP.A (local) ->IP.B (remote) packet passing the output chain should create a tracked connection, so a received packet IP.B->IP.A should match "connection-state=established" in the input chain.

Hey. What about low capacity of space in hAP lite? Watever I did, it says not enough space. Every time.

Try uninstall additional packages, then update. After update install packages.

In terms of connection tracking there will be always the one that initiates/creates (call it whatever you like) new connection. If remote device trying to initiate connection it should not be accepted by "establish/related" rule because connection does not exist yet. That is what happened before the fix.

nmt1900 - Can you reproduce this problem once more? Actually. sounds that this was simply a coincidence and the problem was caused by something else besides static ARP entries

Updated the router to the current version.
After the update, we can not work. LAN computers behind RB951 cannot connect to PPTP servers.
We stopped work. Help.

P.S. Sorry, I know English very bad.

PPTP uses GRE to transport data. If the PPTP connections seem to be up but no data actually pass through them, look earlier in this thread for the firewall rule necessary to allow GRE to work. As the PPTP clients run on the LAN computers, not on the Mikrotik itself, the rule will have to be effective in the forward chain.

1    ;;; defconf: accept established,related,untracked
      chain=input action=accept connection-state=established,related,untracked log=no log-prefix="" 

 2    ;;; defconf: drop invalid
      chain=input action=drop connection-state=invalid log=no log-prefix="" 

 3    ;;; defconf: accept ICMP
      chain=input action=accept protocol=icmp 

 4    ;;; defconf: drop all not coming from LAN
      chain=input action=drop in-interface-list=!LAN log=no log-prefix="" 

 5    ;;; defconf: accept in ipsec policy
      chain=forward action=accept log=no log-prefix="" ipsec-policy=in,ipsec 

 6    ;;; defconf: accept out ipsec policy
      chain=forward action=accept log=no log-prefix="" ipsec-policy=out,ipsec 

 7    ;;; defconf: fasttrack
      chain=forward action=fasttrack-connection connection-state=established,related 

 8    ;;; defconf: accept established,related, untracked
      chain=forward action=accept connection-state=established,related,untracked 

 9    ;;; defconf: drop invalid
      chain=forward action=drop connection-state=invalid log=no log-prefix="" 

10    ;;; defconf:  drop all from WAN not DSTNATed
      chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN log=no log-prefix="" 

11    ;;; Drop BOGONS List
      chain=input action=drop src-address-list=BOGONS in-interface-list=WAN log=yes log-prefix="" 

Could you give an example of the rule?

• as we talk about multiple PPTP servers, you probably need to use src-address-list in the rule, which contains addresses of all the servers, not just a single src-address,
• as we talk about the forward chain, you need another rule where the same address-list is used as dst-address-list, as the first packet to be tunneled via GRE may come from either direction.

Everyone who is experiencing problems with Winbox authorization - we will release a new Winbox loader with a fix for this problem as soon as possible. We are very sorry for any inconvenience caused.

Some routers after upgrade not allow login

Username or password incorrect.

/ip firewall filter add chain=forward action=accept protocol=gre src-address=ip.address.of.the.PPTP.server

It must be at the right place in the forward chain. If you're not sure, create a dedicated topic and post the export of your configuration there. See my automatic signature for details.

The rule should be placed between rules 8 and 9 in your /ip firewall filter print above.

And more than that:

• as we talk about multiple PPTP servers, you probably need to use src-address-list in the rule, which contains addresses of all the servers, not just a single src-address,
• as we talk about the forward chain, you need another rule where the same address-list is used as dst-address-list, as the first packet to be tunneled via GRE may come from either direction.

/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes

/ip firewall service-port
set pptp disabled=yes

This is a bug, or so it is conceived?

Why does this affect forward pptp?

Code: Select all

/ip firewall service-port
set pptp disabled=yes

ludvik - On some specific and very rare case Ethernet interface on TILE routers could lock up. Now this problem is resolved;
ndbjorne, kobuki, smileymattj - Bugfix version (long-term) will be released as soon as possible;
eworm, matiaszon, toxmost, Stanleyssm, wpeople, petrb, lomayani - I recommend that you provide supout file to support@mikrotik.com in order to get more information about the problem that you are experiencing;
pacman88 - CRS3xx switches now can better handle traffic passing through the switch if interface speeds are different;
nmt1900 - Can you reproduce this problem once more? Actually. sounds that this was simply a coincidence and the problem was caused by something else besides static ARP entries;
raystream, nichky, LetMeRepair, proximus, Cha0s, 3bs, Vlad2, sterod, mserge, STEVEUK1, elgrandiegote - We can not seem to reproduce the problem with Winbox login. Can you provide more details? From which version did you upgrade your router? Do you, for example, use RADIUS for Winbox authorisation?
SimWhite, nuffrespect, w0lt, snake27, Hyperlight - Please try to add a new firewall rule at every end of the tunnel and see if it starts to work properly? The rule should be located at the top (at least before drop rules) of input firewall filter rules chain (/ip firewall filter add chain=input action=accept protocol=gre src-address=[address that is configured as a remote-address on your GRE tunnel interface]);
rifkytech, bleblas, marcperea, mducharme, nerxu, jwilkinson6028 - If you cannot login into your router by using API please make sure that you have updated API authentication script (https://wiki.mikrotik.com/wiki/Manual:API#Initial_login);
anav - Is this problem related to RouterOS v6.45.1 or this is simply a configuration related question?
OndrejHolas - We will resolve this problem as soon as possible;
markos222 - Currently fix is available only in v6.45. Fix will be backported to long-term versions aswell;
adonato - MIPS and MMIPS are two differnet architectures. Is it RB750 or RB750Gr3? Please name precise model.

Hello I have a RouterBOARD 750G r3


uptime: 14h59m39s
version: 6.44.3 (stable)
build-time: Apr/23/2019 12:37:03
factory-software: 6.36.1
free-memory: 167.8MiB
total-memory: 256.0MiB
cpu: MIPS 1004Kc V2.15
cpu-count: 4
cpu-frequency: 880MHz
cpu-load: 6%
free-hdd-space: 172.0KiB
total-hdd-space: 16.3MiB
write-sect-since-reboot: 146662
write-sect-total: 84183238
bad-blocks: 0%
architecture-name: mmips
board-name: hEX
platform: MikroTik

RouterOS version 6.45.1 (2019-Jun-27 10:23) has broken RADIUS PAP auth!!!

We have 500+ clients with Mikrotik devices and 27 june in our RADIUS server we see many errors from Mikrotik devices:

Mon Jul 1 11:04:53 2019 : Auth: Login incorrect (rlm_pap: CLEAR TEXT password check failed): [XX-XX-FA-92-17-09/XX-XX-FA-92-17-0] (from client internet-network port 2152726528 cli XX:XX::FA:92:17:09)
Mon Jul 1 11:12:29 2019 : Auth: Login incorrect (rlm_pap: CLEAR TEXT password check failed): [XX-XX-80-DC-6F-96/XX-XX-80-DC-6F-9L1\313\033\\ݍ\351\037\231,\205\201҅\236] (from client internet-network port 2152726529 cli XX:XX::80:DC:6F:96)
Mon Jul 1 11:12:40 2019 : Auth: Login incorrect (rlm_pap: CLEAR TEXT password check failed): [XX-XX-80-DC-6F-96/XX-XX-80-DC-6F-9\006o\377\255\202[\224>\264\351\3103%xe\234] (from client internet-network port 2152726530 cli XX:XX:80:DC:6F:96)
... and man many many logs ...

After update to 6.45.1 all request from Mikrotik to RADIUS have broken last symbol in password (PAP, plain text)

We reproduce this bug in our office on 5+ devices.

How i can open bug report to this error?

Sorry, bu Does anyone know what to do??

RouterOS version 6.45.1 (2019-Jun-27 10:23) has broken RADIUS PAP auth!!!

We have 500+ clients with Mikrotik devices and 27 june in our RADIUS server we see many errors from Mikrotik devices:

Mon Jul 1 11:04:53 2019 : Auth: Login incorrect (rlm_pap: CLEAR TEXT password check failed): [XX-XX-FA-92-17-09/XX-XX-FA-92-17-0] (from client internet-network port 2152726528 cli XX:XX::FA:92:17:09)
Mon Jul 1 11:12:29 2019 : Auth: Login incorrect (rlm_pap: CLEAR TEXT password check failed): [XX-XX-80-DC-6F-96/XX-XX-80-DC-6F-9L1\313\033\\ݍ\351\037\231,\205\201҅\236] (from client internet-network port 2152726529 cli XX:XX::80:DC:6F:96)
Mon Jul 1 11:12:40 2019 : Auth: Login incorrect (rlm_pap: CLEAR TEXT password check failed): [XX-XX-80-DC-6F-96/XX-XX-80-DC-6F-9\006o\377\255\202[\224>\264\351\3103%xe\234] (from client internet-network port 2152726530 cli XX:XX:80:DC:6F:96)
... and man many many logs ...

After update to 6.45.1 all request from Mikrotik to RADIUS have broken last symbol in password (PAP, plain text)

We reproduce this bug in our office on 5+ devices.

How i can open bug report to this error?

This reports should be made by e-mail to support@mikrotik.com .

I have already reported it for hotspot ( #2019070222007151 ) and other person also found same problem in wireless authentication : viewtopic.php?f=19&t=149811

I did not receive any response from my ticket .

Upgraded RB4011 from 6.44.3 to 6.45.1 - no issues

Well, actually there is one - the bridge MAC address has changed so the network discovery on Windows must be done again. In my case the bridge MAC addr is the same as for eth7 interface. Interesting what it depends on...
Best
Bam