In September, critical vulnerabilities were discovered in RouterOS that allow remote administrative access to the system. This cheat sheet covers the practical step-by-step process of updating RouterOS.

Initial Setup and Checks#

  1. Connect to the system via SSH using an account with administrative privileges.

  2. Check the current OS version and available disk space:

# Fields of interest: `version` and `free-hdd-space`
# Make sure you have enough free disk space
/system resource print
  1. Back up the current configuration.

The system configuration can be saved in both binary and text formats (as export commands). I recommend keeping both:

# Create backups
/export file=Mikrotik-Backup-260910
/system/backup/save name=Mikrotik-Backup-260910

Download the newly created backup files from the router to your local machine. Run these commands on your workstation:

# Example for Windows Command Prompt (cmd)
# Use your actual admin login and IP address
scp [email protected]:/Mikrotik-Backup-260910.rsc .
scp [email protected]:/Mikrotik-Backup-260910.backup .
  1. Check for available RouterOS updates:
/system package update check-for-updates

The output will display your installed version and any available update. Example:

 channel: stable
 installed-version: 7.24
 latest-version: 7.24.2
 status: New version is available

Update Process#

Standard Update#

This command automatically downloads the required packages and reboots the device to apply them:

/system package update install

Manual Update#

  1. Download the latest OS release and necessary packages from the official Mikrotik website . Select the Stable channel (or LongTerm if you prefer thoroughly tested releases) and the architecture matching your device. To check your architecture, run /system resource print. To list installed packages, use /system package print.

  2. Upload the firmware package (and extra packages, if applicable) to the router:

scp routeros-7.24.2-arm.npk [email protected]:
  1. Reboot the device. The update will install during startup:
/system/reboot

Verification#

  1. Verify the installed OS version and packages after rebooting:
/system/package/print

  1. After a successful upgrade, you can optionally export a new text configuration and diff it against the old one to check for any syntax or service changes between releases.

  2. If the update failed to apply, inspect the system logs:

/log/print without-paging

Bootloader Upgrade (Optional)#

Mikrotik strongly recommends upgrading the RouterBOOT bootloader (board firmware) after updating the main OS.

# Check current status
/system/routerboard/print

# Upgrade RouterBOOT firmware
/system/routerboard/upgrade

Reboot the router to apply the bootloader changes:

/system/reboot