CVE-2026-67280

What's new in 7.25beta5 (2026-09-16):

*) bridge - fix host-table entry removal on CRS8xx devices (introduced in v7.25beta4); *) bridge - warn about VLAN entries when vlan-filtering is disabled; *) bth - add default client DNS and allowed IPs settings; *) certificate - refactor certificate internal processes (additional changes); *) console - fix export order of ordered lists such as firewall filter rules (introduced in v7.25beta3); *) container - fix veth interface left running after restarting a stopped container; *) l3hw - optimize ECMP nexthop offloading; *) leds - fix missing LED triggers when an R11e card is installed; *) lte - fix missing new firmware update notification on some modems; *) lte - improve system stability when using Quectel EP06-E MBIM modem (additional fixes); *) netinstall - add branding-and-custom-packages parameter for custom NPK packages; *) poe-out - add port-type field to poe monitor and print output; *) poe-out - firmware update for 802.3at capable boards (the update will cause a brief power interruption to poe-out interfaces); *) poe-out - firmware update for 802.3bt capable boards (the update will cause a brief power interruption to poe-out interfaces); *) poe-out - fix PoE ports entering overload state when a PSU is fed from a UPS; *) ptp - fix dropped packets on bridges with IGMP snooping and add vlan-id port setting; *) sfp - improve QSFP-DD link establishing to NVIDIA DGX Spark and other devices (additional fixes); *) ssh - add client host key verification; *) ssh - warn users when weak RSA key is being used (additional fixes); *) system - improve stability (includes CVE-2026-67280); *) system - reboot automatically when the boot process fails to start; *) system - show health settings and overtemp options based on device capabilities (additional fixes); *) vlan - warn when a VLAN interface is created on a slave interface; *) webfig - improve comboboxes to select the first matching option while typing; *) wifi - fix per-link client statistics for MLO connections; *) wifi-mediatek - fix 4.9 GHz band operation on the A42 (additional fixes); *) winbox - fix wg-import creating an WireGuard interface without a config file; *) wireguard - support comment lines in wg-import configuration files; *) wireguard - treat empty private-key and preshared-key values as none; View changelogs