MikroTik Router/Switch/Wireless

[TanKianW]

MikroTik has released their first Long Term RouterOS build in their Version 7.x stream: RouterOS Version 7.20.7. MikroTik reached this milestone more than 4 years after releasing Version 7.1 to their Stable channel.

This is great news!

Lesser 2nd-guessing on stability (usually lesser cutting-edge features or major changes), more production-ready.

Will be upgrading the majority of my appliances still on 7.19.X. But will probably hold for a while and test out the MLAGG feature, which tends to break between updates.​

 

[BBCWatcher]

For those of you who have MikroTik equipment that's compatible with OpenWrt (or will be in the future), there's some recent good news. MikroTik introduced a bootloader change in RouterOS 7.19.6 released on September 12, 2025. If you update your RouterBOARD bootloader to 7.19.6 or higher, you should still be able to boot OpenWrt. Previously you had to keep your bootloader at Version 6.x to retain compatibility with OpenWrt. (Version 6.49.19 is currently the latest Version 6 release.) Here's the 7.19.6 Changelog entry:

routerboot - fixed load of other kernels (e.g. OpenWrt) on NAND-less boards with MT762x, IPQ40xx, QCA955x and QCA953x CPUs ("/system routerboard upgrade" required)

For RouterOS 7 currently Version 7.21 is the latest Stable release and Version 7.20.7 is the latest (and first) Long Term release.

 

[TanKianW]

For those of you who have MikroTik equipment that's compatible with OpenWrt (or will be in the future), there's some recent good news. MikroTik introduced a bootloader change in RouterOS 7.19.6 released on September 12, 2025. If you update your RouterBOARD bootloader to 7.19.6 or higher, you should still be able to boot OpenWrt. Previously you had to keep your bootloader at Version 6.x to retain compatibility with OpenWrt. (Version 6.49.19 is currently the latest Version 6 release.) Here's the 7.19.6 Changelog entry:

routerboot - fixed load of other kernels (e.g. OpenWrt) on NAND-less boards with MT762x, IPQ40xx, QCA955x and QCA953x CPUs ("/system routerboard upgrade" required)

For RouterOS 7 currently Version 7.21 is the latest Stable release and Version 7.20.7 is the latest (and first) Long Term release.

Though I don't load OpenWRT on my MikroTik equipment, this is good news for tinkerers.

Personally I still prefer RouterOS over OpenWRT.


Pro Tip: Once you go the route of IaC (infrastructure as code) using Terraform with ROS, you are not looking back. Makes lots of sense for those looking at enterprise production setup.

For the few that are looking to build your own AI clusters in your worklab/high-end homelab, with the right drivers, you can activate RDMA (Remote Direct Memory Access) protocol for optimal latency and connect these machines over the newer CRS switches (Eg. CRS812, CRS804) that come equipped with 400G fibre interconnects using the QoS feature of MikroTik equipment for RoCE (RDMA over converged ethernet).​

 

[BBCWatcher]

MikroTik has announced a new dual band Wi-Fi 7 router: the hAP be lite, product code A42G-HbeP. And it's a bargain with a list price of only US$79.

Specifications include a dual core 32-bit ARM processor running at 950 MHz, 512MB of RAM, 128MB of flash, a MediaTek-based wireless chipset (good for possible future OpenWrt support), one 2.5GBASE-T port, three 1000BASE-T ports, and power input via a USB-C connector instead of a proprietary DC connector. MikroTik includes a USB-C power adapter in the package. This model does not include any USB-A or USB-C ports for attaching accessories such as a USB thumb drive, and it does not support any form of PoE in or out.

The hAP be lite's 2.4 GHz and 5 GHz radios support 2 spatial streams each, and MLO is also supported. Please note that the specifications indicate up to 2,882 Mb/s (physical rate) on the 5 GHz radio, but that's with 160 MHz channel width. We don't have any non-DFS 5 GHz Wi-Fi channels in Singapore that wide, so that transmission rate is generally unrealistic even if you are allowed to configure such a wide channel in the Singapore regulatory domain. More realistic is 1,442 Mb/s (physical data rate, 80 MHz wide channel), and then overheads and other losses will accrue from there.

Both this new hAP be lite and the previously announced hAP be3 Media (list price US$179) are currently out of stock. For some reason MikroTik has taken longer than expected to get the hAP be3 Media delivered to customers.

 

[BBCWatcher]

Getic.com now has the MikroTik hAP be lite in stock for about US$69 plus shipping and GST.

 

[BBCWatcher]

MikroTik has released RouterOS updates across all long-term and stable streams that contain an important security-related fix. MikroTik claims that most home users are unaffected, but they still recommend upgrading as soon as reasonably possible. Releases 6.49.20, 7.21.5, and 7.23.2 contain the fix.

 

[xiaofan]

MikroTik has teased upcoming availability of their hAP be3 Media device, stylized as hAP be³ Media. The MikroTik hAP be3 Media is a triple band Wi-Fi 7 router with five (5) 2.5GBASE-T ports, 1 USB-C port, 2 USB-A ports, a microSD card slot, Bluetooth 5.4, PoE-in, and support for Matter and Thread "smart home" technologies. It has a 64-bit quad core ARM processor, 2GB of RAM, and 512MB of onboard NAND flash for RouterOS. The data sheet isn't available on MikroTik's Web site yet, but it leaked here. Retail prices aren't available yet, but one distributor suggests it may be as low as €119 (currently about S$180) — plus shipping and GST to Singapore. The formal model code is MA53UG+HbeH.

YouTube review

 

[xiaofan]

Lawrence Systems review of RouterOS with hAP ax2

 

[BBCWatcher]

MikroTik's "fat client" management tool for RouterOS is called "WinBox," probably because it only ran on Microsoft Windows. Fortunately, starting only a couple months ago with Version 4.0, WinBox is now also available for macOS and Linux. More precisely, WinBox now works with Windows on 64-bit X86, Windows on 64-bit ARM, macOS on Intel X86, macOS on Apple Silicon, and Linux on 64-bit X86. Moreover, MikroTik still offers mobile apps for iOS and Android, RouterOS's built-in Web user interface (in "Quick Set" and "Webfig" variants), and command line access. Pick your favorite user interface(s), as you prefer.

The easiest user interfaces for typical home users are RouterOS's Quick Set and the MikroTik Home mobile app (available for Android). Stay within Quick Set (or MikroTik Home for Android) unless there's some configuration option you really need that's only available in one of the other, more advanced user interfaces.

 

[BBCWatcher]

MikroTik has released RouterOS updates across all long-term and stable streams that contain an important security-related fix. MikroTik claims that most home users are unaffected, but they still recommend upgrading as soon as reasonably possible. Releases 6.49.20, 7.21.5, and 7.23.2 contain the fix.

MikroTik has updated their security advisory to urge their customers to upgrade to at least the following minimum RouterOS release levels:

• RouterOS 6 Long-Term: 6.49.21
• RouterOS 7 Long-Term: 7.23.4
• RouterOS 7 Stable: 7.24.2
• RouterOS 7 Development: 7.25 beta 3

If you're running a prior RouterOS release within your stream, you're running with at least one known security vulnerability. The vulnerability may not be exploitable in default home configurations, but it's significant enough that MikroTik urges you to upgrade quickly.

Many MikroTik customers report trouble updating their MikroTik devices with 16MB of flash to the newest RouterOS release levels especially in the Stable and Development streams. Sometimes there simply isn't enough space available. If you have a 16MB flash device you may wish to stay on (or switch to) a Long-Term stream.

 

[BBCWatcher]

Following up on the previous post, these CVEs were published on September 5, 2026:

• CVE-2026-86060
• CVE-2026-67281
• CVE-2026-67279
• CVE-2026-67278
• CVE-2026-67277
• CVE-2026-67276

These security vulnerabilities have already been exploited "in the wild," although most home users should be OK since default home configurations do not expose these vulnerabilities to the public Internet. However, if there's a compromised device on the "LAN side" of your network, it could be used to attack a vulnerable MikroTik RouterOS release from the "inside."

If your MikroTik RouterOS device has any administrative services open to the public Internet, it's possible your device has already been compromised — or will be soon if you don't take prompt action. If your device has been compromised you'll typically see a user named "ops" that an attacker has added to your device. This "ops" user will have full access privileges. It's unclear what the attacker(s) plan to do with this toehold, or what they've already done. Also check your device's log for any alerts after you update. If your device has been compromised it's best to perform a complete "ground up" reset using MikroTik's Netinstall with a brand new configuration with new passwords. Also disable any/all administrative interfaces that you don't need.

This incident emphasizes the importance of access to ongoing security updates, prompt vendor response, responsible disclosure, and a cautious approach when configuring your devices including carefully segregating "IoT" gadgets that are more likely to have unpatched, exploitable security vulnerabilities. (Or don't connect IoT devices at all. Does your washing machine really need Internet access?) Consider these factors when you buy networking equipment — including the "free" equipment your Internet provider may supply.