RouterOS is a network operating system based on the Linux kernel developed by MikroTik, pre-installed on RouterBOARD devices. It can also be installed on a PC, turning it into a router with a firewall, VPN server and client, and wireless access point. The system can serve as a customizable captive portal for a wireless access point. Additionally, MikroTik offers RouterOS images for use in virtual machines and cloud services, called Cloud Hosted Router (CHR), available as a virtual machinedisk image for various virtualization solutions, including the Amazon Web Services marketplace.
RouterOS can be configured via a command-line interface accessible through serial port, telnet, and Secure Shell (SSH), and via a graphical user interface available as a web-based interface (WebFig), a Microsoft Windows-based software application (Winbox), and apps for iOS and Android. An application programming interface (API) allows the development of specialized applications for monitoring and management.
SwOS is an operating system designed for RouterBOARD's line of switches. It is based on a subset of RouterOS features.
History
MikroTik was established in 1996 by founders John Tully and Arnis Riekstiņš in Riga, Latvia. In 1997, the company developed routing software for standard x86 computers that would eventually evolve into RouterOS. The earliest version was based on the Linux kernel 2.0, while the first stable RouterOS release, released in 1999, was based on Linux 2.2.
In 2002, MikroTik expanded its product line by producing their own networking-focused low-powersingle-board computers (SBC), branded RouterBoard, that ran RouterOS. These early SBCs could be expanded and/or integrated as components of other systems, but as time passed, this RouterBoard/RouterOS platform would develop into a full line of network equipment.[additional citation(s) needed]
Licensing model
RouterOS is distributed free of charge. However, features are implemented using a tiered, pay-per-use licensing model.
Versions
RouterOS v7: December 6, 2021 (based on the Linux kernel version 5.6). The latest stable version is 7.24.2, released on September 3, 2026.
RouterOS v6: May 2013 (based on the Linux kernel 3.3.5). The latest stable, long-term version is 6.49.21, released on September 3, 2016.
RouterOS v5: March 2011 (based on the Linux kernel 2.6.35). The latest stable version is 5.26, released on September 14, 2013.
RouterOS v4: October 2009 (based on the Linux kernel 2.6.26). The latest stable version is 4.17, released on March 2, 2011.
RouterOS v3: January 2008 (based on the Linux kernel 2.4.31). The latest stable version is 3.30.
Vulnerabilities
Buffer overflow in the SMB protocol (CVE-2018-7445): A critical vulnerability in the built-in SMB file-sharing service that allowed an unauthenticated remote attacker to execute arbitrary code through specially crafted NetBIOS requests.
Vulnerabilities in WinBox (CVE-2018-14847 and CVE-2024-54772): Historically, the WinBox port (the software for managing RouterOS) has been the target of significant vulnerabilities. The most notorious case allowed directory traversal attacks to read and write configuration files without authentication. Later versions have also exhibited user enumeration issues through differences in response time or packet size.
RADVD Out-Of-Bounds Write (CVE-2023-32154): A critical vulnerability in the IPv6 Router Advertisement Daemon that allowed attackers adjacent to the network to execute arbitrary code with root privileges without prior authentication, due to poor data validation.
Memory corruption in SMB (CVE-2024-54952): A memory corruption vulnerability in the SMB service that allowed unauthenticated remote attackers to cause a denial-of-service attack by sending manipulated packets to block the file-sharing component.
Validación de VXLAN (CVE-2025-6443): Un fallo de control de acceso en el manejo de paquetes VXLAN donde el enrutador omitía la validación adecuada de las direcciones IP de origen remotas, permitiendo a atacantes eludir restricciones perimetrales.
Cross-site scripting in Hotspot (CVE-2025-6563): XSS vulnerability in captive portal functionality that allowed malicious code to be injected through the URL redirection parameter to compromise authenticated user sessions.
Buffer overflow in the REST API (CVE-2025-10948): Localized critical buffer overflow in the JSON parsing function through the REST API endpoint, allowing remote code execution.
WebFig exposure (CVE-2025-61481): Exposure of the default plain text (HTTP) web administration interface in certain initial configurations, facilitating on-path man-in-the-middle attacks to intercept credentials.
Out-of-bounds read in SCEP (CVE-2026-7668): Vulnerability in the SCEP certificate management library within the RouterOS version 6.49.x branches, exploitable by manipulating fields in certificate transactions.
Weaknesses in API session management (CVE-2026-14227): Failures in the expiration of active API sessions, allowing existing sessions to retain elevated privileges after changes in user permissions or group.
API Rate-Limiting Deficiency (CVE-2026-16347): Deficiencies in the handling of rate-limiting for authentication attempts in the operating system API.
Vulnerabilities to denial-of-service attacks (CVE-2026-39042): Logical flaws in internal libraries (such as in the processing of analysis functions) that could cause unexpected restarts or system crashes in response to malformed packets.
