RouterOS 7.25beta3-arm64

Build Time: 2026-09-02 09:02:51 UTC (1788339771)
Architecture: arm64
Channel: development

RouterOS

Type	File
Main package	routeros-7.25beta3-arm64.npk
Extra packages	all_packages-arm64-7.25beta3.zip
ISO Image	mikrotik-7.25beta3-arm64.iso

Cloud Hosted Router (CHR)

Platform	UEFI
Raw disk image	chr-7.25beta3-arm64.img.zip
Open Virtual Appliance	chr-7.25beta3-arm64.ova.zip
QEMU/KVM	chr-7.25beta3-arm64.qcow2.zip
VirtualBox	chr-7.25beta3-arm64.vdi.zip
Hyper-V (legacy)	chr-7.25beta3-arm64.vhd.zip
Hyper-V	chr-7.25beta3-arm64.vhdx.zip
VMware	chr-7.25beta3-arm64.vmdk.zip

Changelog

What's new in 7.25beta3 (2026-09-02):

This is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information.

!) winbox - set minimal supported WinBox version to 4.3;
*) app - add the networkRouterIP variable for container apps;
*) app - fix CHR apps getting stuck on "starting" on slower boards;
*) app - show an error when an app variable cannot be resolved;
*) app - update the environment variables of the docker-with-komodo app;
*) arm64 - improved general system stability;
*) bgp - add the always-compare-med setting;
*) bgp - fix BGP link-local nexthops unreachable over a VRF and a crash when disabling an unnumbered connection;
*) bgp - fix BGP unnumbered connections within a VRF;
*) bgp - include the VNI number in outgoing EVPN routes;
*) bgp - log failed BGP connection attempts;
*) bridge - add dynamic ARP inspection;
*) bridge - add IP source guard;
*) bridge - add mlag-lacp-fallback and mlag-init-delay settings for MLAG;
*) bridge - fix a false "already added as bridge port" error;
*) bridge - fix an MLAG peer getting stuck in the disabled state after config changes;
*) bridge - fix bridge ports not forwarding;
*) bridge - fix MLAG failing to establish after bridge config changes;
*) bridge - fix MLAG MAC handling when used with VRRP;
*) bridge - fix unexpected MAC aging in MLAG after a MAC move;
*) bridge - fix VRRP MAC behavior in MLAG setups;
*) bridge - improve stability;
*) bridge - make MVRP work with MLAG dual bonds;
*) bridge - rename the IGMP last-member-interval property to last-member-query-interval;
*) btest - improve stability;
*) bth - add resumable file uploads;
*) bth - allow file sharing over direct LAN connections;
*) bth - check the available disk space before a file upload;
*) bth - fix the file share getting stuck when disabling;
*) capsman - add hw-protection-threshold;
*) capsman - fix the last-ip value being shown backwards;
*) certificate - allow importing a cross-signed certificate without overwriting the existing one;
*) certificate - fix ACME certificate issuance for wildcard domains;
*) certificate - fix changing the built-in trust store setting (introduced in 7.22.2);
*) certificate - improve certificate import process;
*) certificate - refactor certificate internal processes;
*) cloud - improve stability of backup file downloads;
*) console - allow the array access operator to accept arrays of indices or keys;
*) console - expose globals in the API;
*) console - fix a memory leak in background scripts;
*) console - fix background ":execute as-string" jobs not terminating on interrupt;
*) console - fix comment wrapping in the monitor command;
*) console - fix inconsistent /ip/firewall/filter print with src-address-list and dst-address-list;
*) console - fix the where filter ignoring flags set to false;
*) console - improve export order;
*) console - improve stability;
*) console - prevent an out-of-memory condition when ":execute as-string" produces large output;
*) console - prevent duplicate entries in /port/remote-access;
*) container - add a Ctrl-] escape sequence to exit a stuck container shell;
*) container - fix container interface handling on CHR;
*) container - improve container image extraction;
*) container - require the container device-mode to enable swap;
*) crypto - fix a possible crash during IPsec processing on Qualcomm devices;
*) detnet - use a single random source port;
*) dhcpv4-server - add ipv6-only-preferred parameter to respect option 108;
*) dhcpv4-server - show DHCP option 82 parameters in ASCII in addition to hex;
*) dhcpv6-client - add option 39 with the client hostname;
*) dhcpv6-client - fix DHCPv6 client address handling after prefix-hint changes;
*) dhcpv6-client - remove a duplicate dhcp-options parameter;
*) dhcpv6-relay - use the packet's source MAC for option 79 if relay and client are on the same link layer;
*) dhcpv6-server - add option 39 (FQDN) support and add-dns-entries option;
*) disk - improve RAID5/6 throughput;
*) disk - improve stability of the SMB server;
*) dns - improve stability;
*) dot1x - improve stability;
*) dot1x - rename the reauth-timeout to reauth-period;
*) email - fix server certificate verification;
*) email - show certificate related errors in the log;
*) ethernet - add the arp-accept parameter for interfaces with MAC;
*) ethernet - fix a stability issue on RB1100AHx2 under heavy traffic;
*) ethernet - fix bogus fast-path Rx traffic reported on an unconnected ether8 port on RB5009;
*) ethernet - fix link flap and unexpected reboots on RB5009;
*) ethernet - fix PPPoE link flapping on Intel X710;
*) ethernet - fix PPPoE over VLAN not working on Mellanox ConnectX-4;
*) ethernet - fix SFP compatibility on E-series devices;
*) ethernet - improve stability on Alpine devices after a switch reset;
*) ethernet - improve stability on hAP be3 Media;
*) ethernet - improve stability on x86 routers with Mellanox NICs;
*) evpn - publish MAC-IP routes (RT-2) for neighbors;
*) fetch - improve stability of the TFTP client;
*) fetch - improve upload state reporting when using sftp;
*) fetch - never set a cookie jar for HTTP requests;
*) fetch - show a clearer error when keep-result and output are both used;
*) firewall - add NAT-related fields to CEF format logging;
*) hardware - show the device name and location in /system/resource/hardware menu;
*) igmp-proxy - improve stability when changing /routing/igmp-proxy parameters;
*) iot - add Bluetooth output power control;
*) iot - allow a custom radio plan even under a regional lock;
*) iot - enforce the fixed antenna gain on boards with an embedded antenna;
*) iot - fix round-trip-time timing issues in LoRaWAN Basic Station;
*) ip-service - fix services becoming unreachable after their VRF is disabled and re-enabled;
*) ipsec - add XFRM interface support;
*) ipsec - fix policy and SA handling after moving it to netlink;
*) ipsec - improve IKE handshake stability;
*) ipsec - improved service stability when processing an IKEv1 request;
*) ipv6 - add a neighbor discovery ping;
*) ipv6 - fix cases when address is lost after reboot if prefix was taken from pool;
*) ipv6 - fix the DNS timer in router advertisements;
*) ipv6 - ignore router advertisements received on interfaces not in the accepting list;
*) l3hw - fix IPv6 link-local traffic being routed incorrectly;
*) leds - add dark-mode support for L41;
*) leds - fix LEDs set to interface status staying off when the interface is active;
*) log - improve stability of logging;
*) lte - accept both y and yes for eSIM confirmation;
*) lte - add band display support for Huawei ME909s modems;
*) lte - add missing network error messages for MBIM modems;
*) lte - add support for supplementary downlink and uplink band only selection restriction;
*) lte - add the sms-protocol=qmi option for sending and reading SMS;
*) lte - use RA for IPv6 acquisition for FG621;
*) lte - fixed multi-APN for R11l-LTE7 and R11e-LTE6 modems;
*) lte - fix the RG650E-EU modem not bringing link up after a firmware update;
*) lte - fix traffic statistics in MBIM passthrough mode;
*) lte - remove leftover APN slave interfaces when the master LTE interface is removed;
*) lte - rename "firmware-update" to "firmware-upgrade" in the show-capabilities command output;
*) lte - fix the subscriber number not updating after switching SIM slots;
*) lte - fixed support for MC7710 Sierra modem;
*) lte - fixed IPv6 acquisition for R11e-LTE-US modem;
*) lte - improved link recovery for R11l-LTE7 modem;
*) lte - clear dhcp-server network in passthrough mode when the link goes down;
*) lte - improved system stability when using passthrough mode;
*) mac-telnet - improve stability of MAC Telnet sessions;
*) netinstall - fix a duplicate device entry on RB2011 with SFP;
*) netinstall - fix multiple active interfaces inheriting the first interface's settings;
*) netinstall - fix Netinstall failing to reinstall RB850Gx2 devices;
*) netinstall - fix Netinstaller's memory check failing downloads to disk;
*) ospf - fix DR/BDR traffic not being received with multiple instances;
*) ospf - improve stability when a neighbor is lost;
*) pim - add MLD support for PIM;
*) pim - fix duplicate PIM configuration parameters;
*) pim - fix PIM-SM issues with IPv6;
*) pim - fix wrong or missing PIM configuration by separating PIM and GMP per interface;
*) ping - add parameter checks for arp ping;
*) poe-out - fixed missing PoE-Out interface on hEX PoE lite, RB260GSP, OmniTIK 5 PoE, PowerBox;
*) port - accumulate incoming data in log file even without TCP clients connected;
*) port - add an FTDI latency_timer option for low-latency serial applications;
*) ppp - add port interface info to PPP outbound channel defaults;
*) ppp - fix a packet leak during dial-on-demand connection of a ppp-out interface;
*) ppp - fix BG77 modem port name and channel count;
*) ppp - fix the offline firmware-update notification for BG77/BG770 modems;
*) ppp - fix the SINR value reported for BG77 and BG770 modems;
*) ptp - add support for fixed master and slave port roles;
*) ptp - add transparent clock mode;
*) qos - fix PFC and lossless buffer issues (introduced in v7.23);
*) queue - fix a typo in the cake-overhead-scheme parameter value;
*) reverse-proxy - improve stability of the reverse proxy;
*) romon - improve stability of RoMON;
*) route - fix a nexthop mismatch;
*) routing - improve stability of routing protocol packet handling;
*) sniffer - improve packet time resolution;
*) snmp - add an OID and logging for blacklisted program access;
*) snmp - add CAPsMAN radio data to SNMP;
*) snmp - add dynamic SNMP engine ID assignment;
*) snmp - add interface table with mtu and l2mtu OIDs;
*) snmp - add IP pool OIDs;
*) snmp - add IPv6 address and interface name to the MNDP neighbour table;
*) snmp - add OID blacklisting;
*) snmp - add OIDs for Netwatch probes;
*) snmp - add OSPF MIB tables;
*) snmp - add SHA-2 authentication for SNMPv3;
*) snmp - add transmit drop counters;
*) snmp - add VRRP status OIDs for monitoring;
*) snmp - fix the reported capability flags in LLDP-MIB;
*) snmp - fix the snmp tools timing out when authentication is used;
*) snmp - improve stability of SNMP;
*) snmp - log a warning when the src-address family does not match the request;
*) snmp - remove an interface OID that should not be accessible;
*) socks - fix SOCKS proxy connection and address handling;
*) ssh - add host key verification for the SSH client;
*) ssh - limit server output to the client's window size;
*) ssh - refactor SSH internal processes and improved system stability;
*) ssh - show router host key fingerprint;
*) ssh - switch the default host key type to Ed25519;
*) ssl - enabled hardware accelerated GCM on Alpine CPUs;
*) ssl - improve logging;
*) switch - add packet and byte counters for ACL rules on Marvell Prestera switches;
*) switch - fix degraded slow-path throughput on CRS304 switch (introduced in v7.22);
*) system - fix memory handling and correctness issues in the core library;
*) system - fix the frequency units from Mhz to MHz;
*) system - improve stability;
*) system - reduce the fan control interval on multi-core boards;
*) system - remove the channel label from the RouterOS version;
*) system - warn about a missing wifi driver package on BE boards;
*) tftp - add VRF support;
*) traffic-flow - improved system stability when disabling traffic flow on a busy system;
*) traffic-gen - improve stability;
*) tr069 - improve stability;
*) upnp - improve stability;
*) usb - improve stability of RNDIS data handling;
*) user - fix removal of inactive REST API sessions (introduced in 7.21);
*) userman - improve stability when importing database files;
*) vlan - add a force-mac-address option for VLAN interfaces;
*) vrrp - improve stability;
*) webfig - add a generic table and union group support;
*) webfig - add column resizing to embedded tables;
*) webfig - hide the left menu only on QuickSet and Terminal pages;
*) webfig - improve stability;
*) webfig - update style;
*) webfig - update the login page Help link;
*) wifi - add a stream-port argument to configure the sniffer streaming server port;
*) wifi - add fast transition support for MLD devices;
*) wifi - add interworking, aaa and steering settings to the network configuration;
*) wifi - add more steering debug logs;
*) wifi - add network 'labels' parameter to WinBox and WebFig;
*) wifi - do not preserve branding package on cap when upgrading via capsman;
*) wifi - fix channel reselect interval/time operation for wifi-qcom-be and wifi-mediatek interfaces;
*) wifi - fix incorrect scan results for 320 MHz access points;
*) wifi - fix MLD link type change and SA query in station mode;
*) wifi - fix SAE authentication using a wrong cached PMK;
*) wifi - fix station statistics not updating after switching MLD links;
*) wifi - fix the interworking network type;
*) wifi - fix the wrong band shown in the registration table;
*) wifi - improve stability;
*) wifi - perform a channel switch instead of dropping clients on radar detection;
*) wifi - preserve dude package on cap when upgrading via capsman;
*) wifi - report channel in log messages;
*) wifi - report management frame protection (MFP) usage in registration-table;
*) wifi - show the EAP user identity in the registration table;
*) wifi - show the MLD links and SSID in MLO client log messages;
*) wifi-mediatek - improve MLO client reconnection;
*) wifi-qcom - fix disconnects during fast transition roaming;
*) wifi-qcom - fix station mode association failures;
*) wifi-qcom-ac - fix a regression in station MAC address handling;
*) wifi-qcom-ac - reduce package size;
*) wifi-qcom-be - add hw-protection-mode support;
*) wifi-qcom-be - add the distance setting for 802.11be devices;
*) wifi-qcom-be - fix the block ack request being declined after a channel switch;
*) wifi-qcom-be - fix Wi-Fi intermittently unavailable after reboot;
*) wifi-qcom-be - improve throughput in dense client environments;
*) wifi-qcom-be - upgrade driver and firmware;
*) winbox - add a filtered LLDP tab to neighbor discovery;
*) winbox - add a Security tab and reorganize bridge and port dialogs;
*) winbox - add a wifi radio regulatory info (reg-info) view;
*) winbox - add device-mode configuration;
*) winbox - add ISIS support;
*) winbox - add progress bar support to the GUI;
*) winbox - add RSRP and RSRQ signal graphs to the PPP info view;
*) winbox - add the client MTU option for WireGuard peers;
*) winbox - add the container save option;
*) winbox - add wifi Spectral Scan support;
*) winbox - allow power-cycling multiple interfaces at once;
*) winbox - allow tuple fields with more than two values and multiple separators;
*) winbox - fix SFP optical power values of 0.0 dBm not being shown;
*) winbox - fix the "addresses" spelling in read-only fields;
*) winbox - fix the EC/IO signal quality graph;
*) winbox - fix the ISIS neighbor level type being empty for "l2";
*) winbox - fix the Memory Limit field of fq_codel to use bytes;
*) winbox - fix the Min Prefix field in the routing rule dialog;
*) winbox - fix the MPLS TE tunnel path hops field;
*) winbox - fix the range field displayed in route filters;
*) winbox - fix the Skins menu for user groups opening a non-existent window;
*) winbox - fix the system note display on startup;
*) winbox - fix the wifi Authentication Types and Encryption fields;
*) winbox - improve stability of WinBox protocol handling;
*) winbox - improve status reporting under Tools/Email menu;
*) winbox - make the Power Cycle button act only on the selected interface;
*) winbox - open the Format Drive panel only for supported disks;
*) winbox - remove the redundant empty status field from the License window;
*) winbox - rename "send" to "transmit" in the Bandwidth Test window;
*) winbox - rework the switch QoS statistics table;
*) winbox - show WireGuard peer information;
*) wireguard - add the client-mtu parameter;
*) wireguard - allow referencing a peer by its name;
*) wireguard - allow unsetting the client-listen-port;
*) wireguard - improve error message reporting when adding a new peer;
*) wireguard - keep peer rx/tx counters when the peer is disabled and enabled;
*) wireguard - use the MTU value when importing a configuration;
*) wireguard - warn when an allowed-address overlaps another peer;
*) www - add the remote client IP and domain to HTTPS log messages;
*) www - fix a memory leak when parsing authentication headers;
*) www - improve stability;
*) www - improve URI parsing;