Outdated RouterOS version with known vulnerabilities

What the audit found

The version line at the top of your export shows a RouterOS release that is behind the current long-term or stable branch. Depending on how old it is, the finding may say one of several things: that a 6.x release is on the end-of-life branch and will receive no further security patches; that a 7.x release is significantly behind and missing published fixes; or that a specific known vulnerability (identified by its CVE number) affects your version. It may also remind you to upgrade the RouterBOARD bootloader, which is updated separately from the operating system.

Severity depends on how far behind the router is and on whether the affected feature is actually in use in your configuration.

Why it matters

Old RouterOS releases are not vulnerable in theory. They are vulnerable in the specific, documented ways that attackers have already automated.

The clearest example is CVE-2018-14847: a Winbox flaw that let anyone read the router's user database — including passwords — without logging in. It was fixed in 6.42.1, yet hundreds of thousands of devices were taken over in the months afterwards because they were never updated. Those routers were used for cryptomining, DNS hijacking, and later as nodes of the Mēris botnet that produced record-breaking DDoS attacks in 2021. Many of them are still online and still being exploited, years later.

Other examples in the audit's database include CVE-2018-7445, a pre-authentication bug in the SMB service that gives remote code execution, and CVE-2023-30799, which lets anyone with an ordinary admin login escalate to full control of the underlying system. Each of these has a public exploit. A scanner needs only the version banner to know which one will work.

There is also a simpler point: RouterOS 6 is end-of-life. Whatever the next Winbox or web-interface bug turns out to be, a 6.x router will not get the fix.

What it looks like in Winbox

The version appears in the Winbox title bar and under System → Resources (Version). System → Packages lists the installed packages with their version, and System → Packages → Check For Updates shows what is available on the selected channel. The bootloader version is under System → RouterBOARD (Current Firmware vs Upgrade Firmware).

How to fix it

The principle is a three-step sequence: take a backup, upgrade RouterOS, then upgrade the bootloader. Start under Files by saving a binary backup, and also export a readable copy of the configuration so you have both formats to fall back on. Then open System → Packages, choose your update channel — long-term is the sensible choice for production routers, stable gets features sooner — check for updates and install; the router reboots automatically. Once it is back, go to System → RouterBOARD and request the firmware upgrade, which takes effect on the following reboot, so reboot once more when convenient.

If you are moving from RouterOS 6 to 7, read the MikroTik upgrade notes first: most configurations convert cleanly, but some areas (routing filters, the wireless package on certain models) changed and deserve a check afterwards. Do a major upgrade in a maintenance window and keep console or physical access available, since a reboot on a remote device is the one moment Safe Mode cannot help you.

Afterwards, confirm under System → Resources that the new version is running and under System → RouterBOARD that Current Firmware matches Upgrade Firmware, and make sure your services, VPNs and wireless still behave as before. Then re-run the audit with a fresh export: the version finding and any CVE findings tied to it should disappear.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

I disabled the vulnerable service (for example Winbox or SMB). Am I safe on the old version?

Safer, and the audit lowers the finding when the affected feature is off. But you are still relying on every other component of an old release being bug-free, which it is not, and RouterOS 6 will never receive another fix. Treat disabling the feature as a stop-gap and plan the upgrade.

Will the upgrade break my configuration?

Within the same major version, almost never — MikroTik upgrades are routine and preserve the configuration. From 6.x to 7.x there are documented changes; back up, export, read the release notes for the areas you use, and test in a window when a short outage is acceptable. Downgrading is possible if needed.

Why does the audit mention the bootloader separately?

The RouterBOARD firmware is a separate piece of software that is not replaced by the RouterOS package upgrade. It only updates when you request the upgrade under System → RouterBOARD and reboot. Keeping it current avoids boot-time and hardware issues that the release notes occasionally fix.