RouterOS version 6.49.7 has been released in public "stable" channel!

Before an upgrade:
1) Remember to make backup/export files before an upgrade and save them on another storage device;
2) Make sure the device will not lose power during upgrade process;
3) Device has enough free storage space for all RouterOS packages to be downloaded.

What's new in 6.49.7 (2022-Oct-11 17:37):

*) branding - fixed execution of "autorun.scr" file when installing branding package (introduced in v6.47);
*) routerboot - prevent enabling "protected-routerboot" on unsupported factory firmware versions;
*) routerboot - properly reset system configuration when protected bootloader is enabled and reset button used;
*) system - improved handling of user policies;
*) wireless - fixed disconnection of connected client while running background scan on wAP ac and wAP R ac devices;
*) wireless - fixed missing wireless interface on some RB921GS-5HPacD devices;

To upgrade, click "Check for updates" at /system package in your RouterOS configuration interface, or head to our download page: http://www.mikrotik.com/download

If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as suspected or after some problem has appeared on device

Please keep this forum topic strictly related to this particular RouterOS release.

Is this release affected by those:

CVE-2022-41674: fix u8 overflow in cfg80211_update_notlisted_nontrans (max 256 byte overwrite) (RCE)
CVE-2022-42719: wifi: mac80211: fix MBSSID parsing use-after-free use after free condition (RCE)
CVE-2022-42720: wifi: cfg80211: fix BSS refcounting bugs ref counting use-after-free possibilities (RCE)
CVE-2022-42721: wifi: cfg80211: avoid nontransmitted BSS list corruption list corruption, according to Johannes will however just make it endless loop (DOS)
CVE-2022-42722: wifi: mac80211: fix crash in beacon protection for P2P-device NULL ptr dereference crash (DOS)

Did you check that these CVE are for 5.x kernel (checked 3 of them)? ROS 6.xx is based on older kernel and wifi drivers are made by Mikrotik

ROS 6.x is not dead :-)

ROS 6.x is not death :-)

is not dead :-)

*) system - improved handling of user policies;

What exactly was improved? I personally have not experienced any problems with user policies

Posted into new thread.

screenshot of my firewall filter rule log.

https://ibb.co/02VB6zK

@nabeelryk

What is wrong with your log
You have extra features added on your log

Yes i turned on firewall filter rule log.

Code: Select all

/radius
add address=127.0.0.1 service=ppp

Something tells me you forgot to update the other packages too, not just RouterOS...

@nabeelryk open your own topic, do not pollute this.

User Manager has nothing todo with NAT and firewall and access management.
So whats your point ?

Okey I open a new thread.

*) system - improved handling of user policies;

What exactly was improved? I personally have not experienced any problems with user policies

I haven’t experienced any issues, either. It may be an improvement that isn’t needed for 99.9999% of the MikroTik devices. It is likely a feature request from a particular user who uses user policies heavily.

Updated SXT LTE kit from 6.49.6 to 6.49.7. No new issues found so far.

*) system - improved handling of user policies;

What exactly was improved? I personally have not experienced any problems with user policies

There is a security bug that allows users with limited privileges to elevate them ("become admin"). It requires a specific setup to exist.

Updated my entire network successfully with no issues. Thanks for this update!!!

Regards.

What exactly was improved? I personally have not experienced any problems with user policies

There is a security bug that allows users with limited privileges to elevate them ("become admin"). It requires a specific setup to exist.

Why is this not flagged as a security issue with an accompanying advisory?

No need to wake sleeping dogs...

Exactly... I think it was added to 6.49 as well thanks to my post: [ viewtopic.php?t=188907#p955065 ]
But it is such a peculiar thing, that it is difficult to exploit it if there are not several prerequisites first.

I'm sure you discussing exploiting something that was unpatched that you did not report for your own personal gain helped motivate the change. I'm baffled how you still don't seem to understand how negative this is.

Ah, I'm not well on sarcasm, try to read twice the post and you understand...

It seems that still the same issue with Dude server package like on 6.46.6 discussed here viewtopic.php?t=186624#p927889? Can I update router from 6.49.5 to 6.49.7 without an issue of Dude server OR I have to do it still manulally as described in the post in the link?

Updated CCR1009 and CRS326. Everything is working as it should.

All next version is more consumption CPU.
This is bad road software for me - stop more upgrade. Look this:
https://ibb.co/mb7mTnq
https://ibb.co/YQF6qw0

Really interested what you say regarding new smartphone software.

Hi,
Updated 1 x CCR2004-1G-12S+2XS, BGP router with 14 peers IPv4 and v6. All is fine...

Description
Hello,

We have a CRS 326 24S+ 2Q linked to a Cisco Nexus 9000 using the 40 Gbps interfaces.

SFP are QSFP SR 850 nm.

Everything is working fine until we updated the CRS from 6.48.6 to 6.49.7.

Since this version, FEC options appeared with ROS and link remains DOWN.

Cisco and Mikrotik do not work together anymore. Link is flapping until Cisco decided to bring interface in error-diabled state.

We have tried to turn off FEC instead of auto mode, no link.

None of others options available work.

We tried a 7.6 version of ROS, error remains.

Do you have any idea ?

Thanks for help

Create supout.rif, send it to mikrotik support, not the forum, and repost 6.48.6 while waiting for the fix.

Yes, Thank you rextended
Support is already aware.
Waiting for their answer / fix

*) system - improved handling of user policies;

Did this change backup, now requiring permission "policy"?

Obviously....

May I ask if there's a End Of Life date for release 6.x?
Thanks, BR

May I ask if there's a End Of Life date for release 6.x?

Officially I don't think there is one.

My guess is that there won't be any further v6 release ... unless a very severe exploit hits the streets and a v6 release would fix that. And it would have to be a really major one to make MT fix it in v6 since MT is quite aggressive with claims that v7 is mostly on par with v6 in all aspects.
All the functionality developments are strictly in v7 for over a year now and there don't seem to be any nasty bugs in current v6 releases

since MT is quite aggressive with claims that v7 is mostly on par with v6 in all aspects

Claims, maybe? (where?)
In reality, v7 is not on par with v6 in:
- BGP
- BFD
- routing table queries
- performance on the smallest models
Of course there will be fewer new v6 releases, but they have to remain working and safe to use until v7 is really on par with v6.

- performance on the smallest models

Not to be too picky but they have said V7 is actually NOT meant for the smaller models (I am trying to find back some of the posts where it was stated, but can't find it right away).
While it does work, they have stated clearly this was not the intention. Those models should stay on ROS6.
It will however work for most on the "smaller" models (I have hAP, cAP Lite, mAP, mAP Lite where it works flawlessly for what I need even though those were specifically mentioned as not being capable enough) but when you really stress the config, you will run out of resources.
If you have a device with only 16Mb of memory, forget it. Most likely it will not run.
It's even mentioned in the specifications for ROS 7
https://help.mikrotik.com/docs/display/ ... ifications

Minimum 32MB of RAM, since RouterOS v7 there is no more maximum RAM.

And that's nothing new. They have always been quite open about that.

- performance on the smallest models

Not to be too picky but they have said V7 is actually NOT meant for the smaller models (I am trying to find back some of the posts where it was stated, but can't find it right away).
While it does work, they have stated clearly this was not the intention. Those models should stay on ROS6.

I have never read that from MikroTik. It looks like MikroTik personnel still think there is no problem with the upgrading of hAP lite and mini (32MB RAM, 16MB flash) although we all know the reality is different.
It is also well known that the performance specs in the datasheets for models that were released with v6 do not apply when v7 is installed on them.
I think the performance specs should be labeled with a version (6.xx or 7.xx) or even be split into a 6.xx and 7.xx section for those models that are still being sold.
Now we get angry postings from people claiming "their router gets slower and slower" or "their router refuses to update"...

When MikroTik knew this and would not advise v7, why is a v7 image distributed for those devices (e.g. SMIPS and maybe even MIPSBE)

Don't have them take away my Hex image, please ... (MMIPS) :lol:

SMIPS: the only ones I could find have 32Mb. So that's on the edge. But that does not mean it can not run. If you keep it simple.
MIPSBE: because a lot of those devices have 64Mb hence they can run ROS7. Within their limits too.

Performance specs not being updated, I understand both sides.
I understand the user side wanting accurate reference info.
But I also understand MT since retesting all those devices with all those test is a GIANT job. Wouldn't you rather have them improve ROS7 with that time and resources ?

Found the reference.
It's on the same help page, note 2
https://help.mikrotik.com/docs/display/ ... ifications
But again: even though e.g. RBmAPL-2nD is mentioned (mAP Lite), alle devices I have with the same platform, run just fine. With the config I need (once again).

I also found this recommendation:
viewtopic.php?t=184585#p922647

Don't have them take away my Hex image, please ... (MMIPS) :lol:

SMIPS: the only ones I could find have 32Mb. So that's on the edge. But that does not mean it can not run. If you keep it simple.

It can run. But it cannot be updated. MikroTik employees say "it should be no problem" but in practice it is.

MIPSBE: because a lot of those devices have 64Mb hence they can run ROS7. Within their limits too.

Yes, RAM is not the issue here and flash also often is larger on the old models, so upgrading is not a problem either.
But it is slower than before, and users do not understand that.

Performance specs not being updated, I understand both sides.
I understand the user side wanting accurate reference info.
But I also understand MT since retesting all those devices with all those test is a GIANT job. Wouldn't you rather have them improve ROS7 with that time and resources ?

I think MikroTik has several employees, but not all of them are qualified for the same task.
It seems at this time nobody is qualified to work on the routing code. Likely the employee(s) who coded this is/are no longer available, and development halted. New employees are studying the code and making very small changes a step at a time, but they can not yet take the big job of making v7 on par with v6.

That does not mean there isn't anyone who can fire up the test rack and performance test equipment and run the tests again. That is quite a different type of task and most likely another person doing it.

since MT is quite aggressive with claims that v7 is mostly on par with v6 in all aspects

Claims, maybe? (where?)

Bits and pieces here and there, but mostly claiming v7 can do almost anything v6 does. You know very well how it goes. And yes, many agree that currently v7 is not universal replacement for v6 (in some cases it is, in some far from it). But the attitude by (most?) MT staffers makes me believe they won't put any more effort in v6. And there's some reasoning behind that (e.g. why spend time on improving BGP in v6 if BGP in v7 desperately needs attention).

I would already be very happy when they put an optional v6 BGP package into v7 until they have found the resources to complete the v7 BGP...

I would already be very happy when they put an optional v6 BGP package into v7 until they have found the resources to complete the v7 BGP...

Are you sure it's really as simple as adding some userland code and v6-stype BGP would magically work? I would be quite surprised if that was so.

I would already be very happy when they put an optional v6 BGP package into v7 until they have found the resources to complete the v7 BGP...

Are you sure it's really as simple as adding some userland code and v6-stype BGP would magically work? I would be quite surprised if that was so.

also doubt that would work. guess if it was THAT simple, they might have provided such a workaround or implemented v6 "bgp code" straight to v7
but v7 AFAWK has been a complete rewrite based on a newer kernel (of course)

btw @MikroTik Support:
please look into security related ticket SUP-103257

I guess everything can be made more complicated than it needs to be. All I know is that standard Linux systems can route and can do BGP without any kernel modifications and with BGP running as a simple user process. And when making drastic kernel updates like version 3.x to 5.x, the same BGP user programs (quagga, bird) still work!

Once upon a time, MikroTik BGP was based on Quagga.
When MikroTik was called out for not giving back to the community whatever patches they made to the GPL software they used back then, instead of doing the right thing, the opted to re-invent the wheel writing everything from scratch.

And with BGP, they opted to re-invent the wheel twice, and both times it has been a disaster.
Honestly, I've lost all hope for MikroTik.

I still use v6 for small BGP deployments (for how ever long this can last - with new hardware not supporting v6), and for large deployments (ie full tables) I had to turn to proven solutions like Cisco.

How long can someone wait for a vendor to get their act together? It's been a decade waiting for a working BGP. Enough is enough.

When MikroTik was called out for not giving back to the community whatever patches they made to the GPL software they used back then, instead of doing the right thing, the opted to re-invent the wheel writing everything from scratch.

MikroTik culture struggles with pride. However, humility is bringing them out and I hope to see them do better. There is a great community here and something to build on.

Huge bug in script compiler: after two calls "[ ]" executes all functions defined in the script.

to find out how I got there:
viewtopic.php?p=976194#p976194

to quickly test the bug:

Example code

{
:local test1 do={:put "test1"}
:local test2 do={:put "test2"}
:local test3 do={:put "test3"}
:local test4 do={:put "test4"}
:local test5 do={:put "test5"}
[]
[]
}

@mikrotik
suggestion to move 6.49 into LTS to reduce user confusion.

https://prnt.sc/muKxU0VmnFof

Custome Design not work in webfig..

Are the RouterOS 6.4* releases vulnerable to CVE-2023-32154?

https://www.zerodayinitiative.com/advis ... DI-23-710/

Are the RouterOS 6.4* releases vulnerable to CVE-2023-32154?

https://www.zerodayinitiative.com/advis ... DI-23-710/

related topic
viewtopic.php?t=196303

New version v6.49.8 has been released:
viewtopic.php?t=196411