RUTM16 Firmware Downloads

Main Page > RUTM Routers > RUTM16 > RUTM16 Firmware Downloads

This page contains firmware files for RUTM16 devices. Look to the table below or the changelog to find download links.

Stable firmware - this version has been tested through both internal QA processes and large-scale user deployments. All known issues have been resolved based on user reports and testing feedback. Stable firmware is currently used as the default for updates and is also deployed in mass production. To upgrade firmware using WebUI, follow the instructions in RUTM16 Firmware.
Latest firmware - this is the most recent firmware release, featuring the latest updates, features, and fixes. While it has passed internal testing, it has not yet undergone widespread deployment or user validation. It may still contain undiscovered issues. We recommend testing on a small number of devices before considering broader updates.

Note: packages for Package Manager are independent from firmware and can be downloaded in the Package Downloads page.

RUTM16

File	Type	Release date	Size	MD5	Links
RUTM_R_00.07.24.5_WEBUI.bin	Stable FW	2026.09.15	29 MB	52fb44cb6cb2f3be9328e7897841dbb4	Changelog API
RUTM_R_00.07.25.3_WEBUI.bin	Latest FW	2026.09.24	35 MB	65af3f5d66d4c1ecb734a7fb21517114	Changelog API
RUTM_R_SDK_00.07.25.3.tar.gz	SDK	2026.09.24	503 MB	f926df106c313dcef6e26ccc2a097110

FW checksums

Checksums for firmware files can be found here.

Changelog

RUTM_R_00.07.25.3 | 2026.09.24

Fix
- Services
  - Data to Server: fixed modbus alarm id migrations via keep settings and backup

RUTM_R_00.07.25.2 | 2026.09.17

Improvements
- Services
  - OpenVPN: updated version to 2.7.7
Fix
- Network
  - VRF: fixed network devices not getting claimed when creating new VRF
  - Wireless: fixed PPSK profiles applying to wrong wireless interfaces
  - Wireless: fixed "Auto" option in "Network" when editing SSID configuration
- System
  - Access Control: fixed HTTPS certificate re-generation when TPM key is missing
  - API Core: fixed not correctly redirecting to HTTPS when HTTPS WAN port doesn't equal HTTPS LAN port
CVE Patches
- CVE-2026-75826 - 8.5 (HIGH)

RUTM_R_00.07.25.1 | 2026.09.04

New
- Services
  - Zabbix: added Zabbix agent package
Improvements
- Network
  - BFD: enhanced web page responsiveness through refactoring and caching improvements
  - Dynamic routes: moved instance naming into edit modals
  - Firewall: added additional validation to firewall rules API for source mac and zone
  - Firewall: enhanced web page responsiveness through refactoring and caching improvements
  - Firewall: added MAC address exclusion support
  - IGMP Proxy: enhanced web page responsiveness through refactoring and caching improvements
  - Mobile: refactored band configuration process
  - Mobile: added modem reload after a long time of not being able to connect to an operator
  - Mobile: added signal quality support for SIM switch "On weak signal" rule
  - Mobile: added new argument in "gsmctl" CLI command for signal quality value
  - Mobile: added a new gsmctl command to get SMS service center address
  - NAT64: enhanced web page responsiveness through refactoring and caching improvements
  - Ports Settings: updated port hint style
  - Ports Settings: added additional API validation for auto-negotiation option in port settings
  - QOS: enhanced web page responsiveness through refactoring and caching improvements
  - SMCRoute: enhanced web page responsiveness through refactoring and caching improvements
  - Starlink: enhanced web page responsiveness through refactoring and caching improvements
  - UDP Relay: enhanced web page responsiveness through refactoring and caching improvements
  - VRF: enhanced web page responsiveness through refactoring and caching improvements
  - Wireless: improved user experience for joining wireless networks
  - Wireless: added query parameter to wireless scan endpoint to retrieve cache
  - Curl: updated version to 8.20.0
  - IGMP Proxy: updated version to 0.3
  - iperf3: updated version to 3.20
  - SSHFS: updated version to 3.7.3
  - udhcpc: updated version to 1.36.1
- Services
  - Cumulocity: added c8y_Networks operations
  - Data to Server: added advanced status page
  - Event juggler: added HTTP response code logging
  - GRE: made "Remote endpoint IP address" required
  - IEC 60870-5 Client: added option to accept or skip cyclic transmission from server
  - IEC 60870-5 Server: added option to change server redundancy mode
  - Impulse Counter: added total counter and tags support
  - IPsec: refactored "Remote source IP" and "Local source IP" fields
  - IPsec: added "Update firewall" option
  - IPsec: added conditions to display 'XAuth identity' field and 'EAP' option
  - Modbus Client: added new alarm type that sends voice calls
  - Modbus Client: moved modbus alarm certificates to global certificate manager
  - SNMP: added sender's description in event trap's event text
  - Stunnel: increased the limit of max configurations to 50
  - Stunnel: added a warning to indicate when a service is using an alternative configuration
  - TR-069: added custom Device.VLAN object
  - TR-069: improved Device.IP.Interface object based on "TR-181 Issue 2 Amendment 20", with implementation-specific deviations
  - TR-069: added Device.Firewall object based on "TR-181 Issue 2 Amendment 20", with implementation-specific deviations
  - FreeRadius: updated version to 3.2.10
- System
  - RutOS: updated UCI default configs to use named sections
  - Speed Test: added run timestamp to API response
  - 7zip: updated version to 26.00
  - busybox: updated version to 1.36.1
  - ca-certificates: updated version to 20250419
  - ffmpeg: updated version to 8.1
  - glib2: updated version to 2.88.1
  - iproute2: updated version to 6.7.0
  - ipset: updated version to 7.9
  - iptables: updated version to 1.8.10
  - json-c: updated version to 0.17
  - Kernel: updated version to 6.6.137
  - libcares: updated version to 1.27.0
  - libfuse: updated version to 3.16.2
  - libgcrypt: updated version to 1.10.4
  - libgpg-error: updated version to 1.48
  - libmnl: updated version to 1.0.5
  - libnetfilter-conntrack: updated version to 1.0.9
  - libnetfilter-log: updated version to 1.0.2
  - libnfnetlink: updated version to 1.0.2
  - libnftnl: updated version to 1.2.6
  - libubox: updated version to 2026-02-13
  - nftables: updated version to 1.0.9
  - openssl: updated version to 3.5.7
  - xz: updated version to 5.8.3
  - zlib: updated version to 1.3.1
Fix
- Network
  - DHCP server: fixed an issue where DHCP server lease time could be displayed incorrectly in the status page
  - DNS: fixed "Custom redirect" getting deleted on "Save & Apply" if it was not modified
  - Dynamic routes: fixed NHRP firewall rule creation
  - Dynamic routes: fixed BGP access-list filter handling
  - Firewall: fixed broken NAT reflection when using custom or renamed LAN zones
  - IGMP Proxy: fixed backend API validation to avoid multiple upstream IGMP proxy configurations
  - IGMP Proxy: fixed IGMP proxy API so that it would not let the user configure mobile interfaces
  - Mobile: fixed an issue that could cause a modem restart to be unexpectedly canceled
  - Mobile: fixed incorrectly timestamped data appearing in Status->Realtime Data->Mobile Signal->Hour after a reboot
  - Mobile: fixed RSRP signal value being represented as RSCP in 4G networks
  - NAT64: fixed Jool API return so that it would not return IPv6 addresses as a list with an empty string inside of it
  - Ports Settings: fixed port settings API to correctly return advertisement option
  - Realtime Data: fixed possible data usage jumps in monthly usage
  - Topology: fixed simultaneous map and page scrolling on touchscreens
  - VRF: fixed VRF route migration for DHCP and PPPoE protocols
  - Wireless: fixed display of incomplete wireless interfaces in every place where it is shown
  - Wireless: fixed redirect to LAN page when new incomplete network is created during editing of wireless interface
- Services
  - BACnet: fixed a potential application crash
  - Data to Server: fixed the Y2038 issue affecting the Modbus alarm data
  - Data to Server: fixed data type when reading from OPC UA database
  - DLMS: fixed possible segmentation fault when reading the serial number
  - DLMS: fixed memory leaks
  - DNP3 Client: fixed Test request failures for requests that are not yet enabled
  - DNP3 Client: fixed test function to work with unsaved changes
  - DNP3 Outstation: fixed writing of DNP3 type binary output through data source
  - DNP3 Outstation: fixed write-only data sources when object range start is not 0 and source request uses function 16
  - DNP3 Outstation: fixed segmentation fault when a write-only data source object type is String
  - DNP3 Outstation: fixed invalid parameter error when a write-only data source object type is Binary
  - DNP3 Outstation: fixed incorrect data source behavior when Modbus function 15 is used for the source request
  - Event juggler: fixed default SIM setting for same SIM
  - Event juggler: fixed interface management
  - GPS: fixed connection setting label typo
  - HotSpot: fixed user creation when no groups exist
  - HotSpot: fixed Terms of Service checkbox text not matching configured text color
  - IEC 60870-5 Server: fixed duplicate error messages on API requests
  - Mobile Utilities: fixed OpenVPN status logging
  - Modbus Client: fixed Request test failing after changing options
  - Modbus Client: fixed Modbus Client TCP connections not being reused
  - Modbus Client: fixed permissions and user for uploaded certificates
  - Modbus Client: fixed Serial Modbus Client process not starting from WebUI configuration
  - Modbus Client: fixed saving and applying MQTT message alarm configuration when TLS is enabled
  - Modbus Server: fixed bits to coil conversion for data sources
  - Modem Control: fixed high CPU usage caused by an endless polling loop in full control mode
  - Modem Control: fixed null bytes being sent to the modem when the serial port was opened
  - OPC UA Client: fixed missing warning for blank results when testing OPC UA Client groups
  - OPC UA Server: fixed I/O nodes providing malformed data
  - OPC UA Server: made disable_unencrypted_access option optional
  - Over IP: fixed reconnect in client mode when encryption is enabled
  - Package Manager: fixed package downloads over IPv6 not falling back to IPv4 after a connection failure
  - RMS: fixed the Y2038 issue affecting the reconnect counter
  - SNMP: fixed community names' validation to prevent duplicate community names
  - SNMP: fixed event trap, which is sent when reboot event is triggered by request from SMS
  - SNMP: fixed SysObjectID OID to return Teltonika enterprise OID
  - Stunnel: fixed alternative config being active while service is disabled
  - Stunnel: fixed alternative config causing service to run with wrong permissions
  - Stunnel: fixed firewall rule creation when multiple instances are created
  - Tinc: fixed host configuration not being present if host is missing from the connection list
  - Tinc: fixed route handling for enabled hosts
  - Wake On LAN: fixed "MAC" validation when multiple identical values are selected
  - Zerotier: fixed device name generation
- System
  - 2FA: fixed OTP being displayed in plain text
  - API Core: fixed time overflow
  - Backup: fixed currently installed packages migration scripts not working with device backup
  - Certificates: fixed SCEP not working with 3DES encryption
  - JSON-RPC: fixed file exec process termination
  - Single Sign-On: fixed memory exhaustion when large userinfo response is received
  - Site Manager: fixed an issue where the Site Manager service could be automatically re-enabled after being manually disabled
  - Speed Test: fixed to use correct interface when passthrough is enabled
  - Speed Test: fixed the speedometer not updating its theme correctly in certain scenarios
  - SSH: fixed server not listening on IPv6 address
  - WebUI: fixed wrong logo color in dark mode
  - WebUI: fixed incorrect byte unit display
CVE Patches
- CVE-2025-13462 - 3.3 (LOW)
- CVE-2026-5107 - 4.2 (LOW)
- CVE-2026-12969 - 5.3 (MEDIUM)
- CVE-2026-13595 - 6.8 (MEDIUM)
- CVE-2026-27135 - 7.5 (HIGH)
- CVE-2026-41989 - 6.7 (MEDIUM)
- CVE-2026-43503 - 8.8 (HIGH)
- CVE-2026-46333 - 7.1 (HIGH)

RUTM_R_00.07.24.5 | 2026.09.15

New
- Network
  - Dynamic routes: added "allow as in" and "disable connected check" toggles to BGP
  - Mobile: added APN configuration to the eSIM installation process
  - Mobile: added "eapn1.net" APN for operator "WirelessLogic" to APN database
- Services
  - NETCONF: added NETCONF configuration support
- System
  - WebUI: added French language support
Improvements
- Services
  - Tailscale: optimized Tailscale functionality to reduce RAM usage
  - Tailscale: updated version to 1.96.5
- System
  - Golang: updated version to 1.26.1
Fix
- Network
  - Mobile: fixed an issue where the router would go into a loop and not try the correct APN when auto APN was on
  - Static Routes: fixed static routes dissapearing when used with route based IPsec interfaces
- Services
  - AWS IoT Core: fixed high CPU usage
  - Data to Server: fixed MQTT reconnect problem
  - IPsec: fixed curve448 and curve25519 DH groups not working
  - Modbus Client: fixed missing request address range overlap hint
  - Stunnel: fixed api handling of certificate files in client mode
  - UPnP: fixed ownership of custom lease files
- System
  - PAM: fixed TACACS+ to send "cmd" argument when service equals "shell"
  - Speed Test: fixed speedtest not being able to connect to most servers
  - System Users: fixed password change error
CVE Patches
- CVE-2026-46333 - 7.1 (HIGH)

RUTM_R_00.07.24.3 | 2026.08.28

Improvements
- System
  - Backend: internal improvements and fixes

RUTM_R_00.07.24.2 | 2026.08.13

New
- Network
  - DHCP server: added automatic DHCPv6 server creation for WAN interfaces
  - DHCP server: added "Relay uplink" option for DHCPv6 server
  - Firewall: added port connection limit support
- Services
  - OSPFv3: added OSPFv3
- System
  - NTP: added authentication support for ntpd
  - PAM: added account lockout for local authentication
  - Password Policy: added password history
Improvements
- Network
  - freeradius3: updated version to 3.2.8
  - wireless-regdb: updated version to 2026.05.30
- Services
  - IPsec: added ML-KEM post-quantum key exchange
  - strongSwan: updated version to 6.0.7
- System
  - open62541: updated version to 1.4.18
  - openssl: updated version to 3.5.7
Fix
- Services
  - Data to Server: fixed memory leak in Lua format plugin
  - FreeRADIUS: fixed issue with keep settings
  - SNMP: fixed SysObjectID OID to return Teltonika enterprise OID
- System
  - Backup: fixed RMS config transfer
  - Profiles: fixed RMS config transfer
  - RutOS: fixed SDK docker build
  - SSH: fixed server not listening on IPv6 address
CVE Patches
- CVE-2026-16455 - 6.9 (MEDIUM)
- CVE-2026-18368 - 5 (MEDIUM)

RUTM_R_00.07.24.1 | 2026.07.20

New
- Network
  - Iperf: added iperf to Package Manager
  - Mobile: added "internet.telenor.se" APN for operator "Telenor" into APN database
  - Mobile: added "services.telenor.se" APN for operator "Telenor" into APN database
  - Mobile: added "comgate.m2m" APN for operator "KPN" into APN databse
- Services
  - Stress-ng: added stress-ng to Package Manager
Improvements
- Network
  - Mobile: increased "iot.t-mobile.com" APN priority for T-Mobile operator with 311-882 MCC-MNC
- System
  - Integrity: improved the time it takes to generate integrity database on first boot
Fix
- Network
  - Wireless: fixed received ieee80211 action frame forwarding in station mode
- Services
  - Event juggler: fixed SMS sending failures when messages are sent in rapid succession
- System
  - Troubleshoot: fixed logs from flash inclusion

RUTM_R_00.07.24 | 2026.07.08

New
- Network
  - Mobile: added "soracom.io" APN for "NTT Docomo" and "KDDI" operators to the APN database
  - Mobile: added "internet" APN for "Bite" operator to APN database
Improvements
- Network
  - Dynamic routes: removed redundant interfaces from dropdown
  - Dynamic routes: moved instance naming into edit modals for OSPF
  - Firewall: increased maximum allowed length for "extra" field in traffic rules to 256 characters
  - Internet Status: refactored the web page to leverage caching, improving responsiveness
  - Mobile: updated blocklist and allowlist operator selection modes to use the lists in the user-defined order
  - Mobile: added "Ignore Home Operator Priority" toggle for blocklist and allowlist network selection modes
  - Mobile: added APN priority control for mobile operator
  - Mobile: added ICCID display when SIM card is inserted but not yet unlocked with PIN
  - Realtime Traffic: improved ubus method input validation
  - Static Routes: added default table for IPv4 static routes in API
  - Wireless: added RSSI to hostapd log
  - mt76: updated version to 2025-02-14
- Services
  - Data to Server: added SFTP and FTPS support for FTP output
  - Data to Server: added SFTP strict host key checking support for FTP output
  - Data to Server: added name and MAC code for MQTT topic wildcards
  - DMVPN: updated default ipsec crypto proposal
  - DNP3 Client: added IP address and port filtering options for database API requests
  - Event juggler: added name, serial code, MAC code for MQTT topic wildcards
  - IEC 60870-5 Client: added configuration support for app layer, link layer and APCI parameters
  - IEC 60870-5 Server: added new time_tag option in for server_instance, information object data types support with time_tag value
  - IEC 60870-5 Server: added new information object data types (time tag variants) for information object tags
  - IEC 60870-5 Server: added configuration support for app layer, link layer and APCI parameters
  - IPsec: updated default crypto proposal
  - Modbus Client: added IP address filtering options for database API requests
  - Modbus Client: added constants for MAC, serial and device name in the alarm MQTT action topic
  - MQTT Modbus Gateway: added TPM support
  - MQTT Modbus Gateway: added certificates to global certificate manager
  - Over IP: added TPM support
  - Over IP: added certificates to global certificate manager
  - Over IP: added serial inactivity timeout option
  - SMS Forwarding: added authentication retries for sender email account
  - SNMP: added download icon for the MIB file download button
  - SNMP: set default system name to represent the same value as device's hostname
  - Tinc: updated interface and host settings to support custom dynamic names
  - Tinc: updated port management to ensure only active instances occupy network ports
  - TR-069: added parameter name and parameter value validation when calling "SetParameterValues" command
  - TR-069: added Device.IP.Diagnostics.TraceRoute object based on "TR-181 Issue 2 Amendment 20", with implementation-specific deviations
  - TR-069: improved Device.WiFi.SSID object based on "TR-181 Issue 2 Amendment 20", with implementation-specific deviations
  - TR-069: improved Device.WiFi.Radio object based on "TR-181 Issue 2 Amendment 20", with implementation-specific deviations
  - TR-069: improved TR-069 connection initiation speed to the ACS
  - Traffic Logging: added SFTP strict host key checking support for FTP uploads
  - Wake on LAN: added bulk action for delete and wake device
- System
  - 2FA: improved log messages
  - Backup: added backup generation type selection
  - dropbear: updated version to 2025.89
  - SQLite3: updated version to 3.50.4
Fix
- Network
  - Devices: fixed validation when applying backup
  - DHCP server: fixed DHCP server lease time range validation
  - DHCP server: fixed IPv4 Static Leases page crash when mobile interface is disabled
  - DHCP server: fixed missing validation for passthrough mode IP address in IPv4 Static Leases
  - DHCP server: fixed IP range validation for disabled IPv4 server
  - Dynamic routes: fixed multiple "OSPF" issues related to labels, help texts and placeholders
  - Dynamic routes: fixed "NBMA" help text
  - Dynamic routes: fixed config generation for multiple networks, redistribution options and IPv4 setups when using allow VPN
  - Dynamic routes: fixed NHRP validation errors during backup upload
  - Firewall: fixed traffic rules with TCPMSS target creation
  - Firewall: fixed low TCP throughput when software flow offloading is used over certain interfaces
  - Firewall: fixed zones backup applying for "in" and "out" API options
  - Mobile: fixed SIM switch "On data connection fail" rule triggering unexpectedly when no SIM card is inserted
  - Network: fixed incorrect bridge ports show for interface
  - Ports Settings: fixed "advert" option validation in API
  - VLAN: fixed multiple POST request for /port_based_vlan/config/
  - Wireless: added IEEE 802.11r validation for unsupported encryption modes
- Services
  - Cloud of Things: fixed firmware reading from the file
  - DLMS: fixed incorrect translations
  - DLMS: fixed missing field validation for DLMS COSEM values and DLMS COSEM groups
  - DMVPN: fixed endpoint to return correct remote IP address
  - DNP3 Client: fixed validations for API database queries
  - DNP3 Outstation: fixed deadlock occurring when reading objects defined from data sources
  - EoIP: fixed backup to work correctly
  - Event juggler: fixed static IO name mapping
  - Event juggler: fixed GSM events to send a message for all newly matched ranges, instead of only the first one that matched
  - GPS: fixed geofencing configuration validation
  - GPS: fixed I/O input validation errors during backup upload
  - Hotspot: fixed Hotspot interfaces to be ignored in DHCP config
  - IEC 60870-5 Client: fixed test and scan request body validation
  - IEC 60870-5 Client: fixed device validation
  - IEC 60870-5 Client: fixed inconsistent server address requirement checks
  - IEC 60870-5 Client: fixed required field validation when feature is disabled, added inline serial device hint in serial device configuration modal
  - IEC 60870-5 Client: fixed excessive logging on database query API requests
  - IEC 60870-5 Client: fixed validations for API database queries
  - IEC 60870-5 Client: fixed information object value parsing when using different IO types
  - IEC 60870-5 Client: fixed default timeout t0 and max ASDU size definitions
  - IEC 60870-5 Server: fixed required field validation when feature is disabled
  - IEC 60870-5 Server: fixed error when time_tag option was omitted
  - IEC 60870-5 Server: fixed information object issue where multiple string values could not be used
  - IEC 60870-5 Server: fixed incorrect seconds parsing for time tag
  - IEC 60870-5 Server: fixed default timeout t0 and max ASDU size definitions
  - Impulse Counter: fixed I/O input validation errors during backup upload
  - IPsec: fixed remote endpoints using FQDNs
  - Mobile Utilities: fixed connection loss issue when the "gps_on" rule is executed
  - Modbus Client: fixed incorrect Modbus client data source 64bit value calculation
  - Modbus Client: fixed I/O input validation errors during backup upload
  - Modbus Server: fixed data source issue where reading out of data source range was allowed
  - Modbus TCP over Serial Gateway: fixed single ID option not working
  - MQTT Modbus Gateway: fixed TLS certificates read permission issue
  - MQTT Modbus Gateway: fixed application crash on restart
  - OPC UA Server: fixed service port issue causing the port to always be set to 4840
  - OpenConnect: fixed status endpoint
  - OpenConnect: fixed service not starting after reboot
  - OpenConnect: fixed validation errors when uploading backup
  - OSPF: fixed name overwriting and validation errors during backup upload
  - Over IP: fixed close connections feature for client and server modes
  - RMS: fixed 'rms_status' rule response when the RMS service is disabled
  - SMS Utilities: fixed response message
  - SMS Utilities: fixed SIM switch functionality
  - SMS Utilities: fixed OpenVPN instance validation before enabling it
  - SMS Utilities: fixed WebUI is not accessible via public IP after SMS "webon" command
  - SMS Utilities: fixed device is not accessible via public IP over ssh after SMS "sshon" command
  - SMS Utilities: fixed not updating SSH package local access and ssh wan access configuration parameters after "sshon"/"sshoff" commands
  - SMS Utilities: fixed not updating HTTP package local access configuration parameters after "webon"/"weboff" commands
  - SNMP: fixed minor webui validation bug
  - UPnP: fixed model, serial and uuid field validations
  - Zerotier: fixed backup to work correctly
- System
  - 2FA: fixed OTP code invalidation after successful authentication
  - 2FA: fixed issues with symbols in usernames
  - API Core: fixed endpoints added through SDK not being loaded
  - Auto Reboot: fixed sending ping/wget SMS from chosen modem
  - Backup: fixed uploading older backups with storage memory expansion enabled
  - NTP Client: fixed NTP packet size check to verify that received packet size is at least 48 bytes (standard NTP packet size without optional fields)
  - NTP Client: fixed time sync, when there is no mobile connection
  - Site Manager: fixed keepalive issue where unpaired devices would disappear
  - Site Manager: fixed sync issue where devices would get stuck after pairing
  - Update Firmware: fixed keep-settings behavior for SDK when read-only filesystem is disabled
CVE Patches
- CVE-2025-14282 - 5.4 (MEDIUM)
- CVE-2026-0989 - 3.7 (LOW)
- CVE-2026-0990 - 5.9 (MEDIUM)
- CVE-2026-0992 - 2.9 (LOW)
- CVE-2026-4519 - 3.3 (LOW)
- CVE-2026-5720 - 7.1 (HIGH)
- CVE-2026-31431 - 7.8 (HIGH)
- CVE-2026-40385 - 7.1 (HIGH)
- CVE-2026-40386 - 7.1 (HIGH)

RUTM_R_00.07.23.8 | 2026.07.10

Fix
- Network
  - Wireless: fixed received ieee80211 action frame forwarding in station mode
  - Wireless: fixed STA to AP latency spikes during wireless scanning

RUTM_R_00.07.23.7 | 2026.06.26

Improvements
- System
  - openssl: updated version to 3.0.21
Fix
- Network
  - Mobile: fixed 'Status -> Mobile' page to correctly display band and carrier aggregation information
- System
  - API Core: fixed regression which didn't allow saving options with unicode characters

RUTM_R_00.07.23.6 | 2026.06.15

Improvements
- System
  - Backup: restored backup generation to backup without API

RUTM_R_00.07.23.5 | 2026.06.09

Fix
- Network
  - Mobile: fixed application segmentation fault with low signal reconnect enabled
- System
  - Backup: fixed backup generation for child endpoints

RUTM_R_00.07.23.4 | 2026.05.29

Fix
- Network
  - Wireless: fixed wireless scan when switched to DFS channel
CVE Patches
- CVE-2026-2291 - 7.3 (HIGH)
- CVE-2026-4890 - 7.5 (HIGH)
- CVE-2026-4891 - 5.3 (MEDIUM)
- CVE-2026-4892 - 8.4 (HIGH)
- CVE-2026-4893 - 5.3 (MEDIUM)
- CVE-2026-5172 - 7.3 (HIGH)

RUTM_R_00.07.23.3 | 2026.05.21

Fix
- Network
  - Network: fixed validation error when changing interface devices and enabling WAN to LAN at the same time
CVE Patches
- CVE-2026-8914 - 8.5 (HIGH)

RUTM_R_00.07.23.2 | 2026.05.18

Fix
- Network
  - Network: fixed interface and DHCP desynchronization after interface name change
- Services
  - IPsec: fixed xauth not working in certain conditions
CVE Patches
- CVE-2026-31431 - 7.8 (HIGH)

RUTM_R_00.07.23.1 | 2026.05.05

Fix
- Network
  - QOS: fixed incorrect QoS being applied to interfaces after changing interface metric

RUTM_R_00.07.23 | 2026.04.24

New
- Network
  - Mobile: added "iot.melita.io" APN for operator "Melita" into APN database
  - Mobile: added "web.melita" APN for operator "Melita" into APN database
  - Network: added DS-lite protocol support
- Services
  - TR-069: added Device.Ethernet.Interface object based on "TR-181 Issue 2 Amendment 20", with implementation-specific deviations
  - TR-069: added Device.Hosts.Host object based on "TR-181 Issue 2 Amendment 20", with implementation-specific deviations
  - TR-069: added Device.NAT.PortMapping object based on "TR-181 Issue 2 Amendment 20", with implementation-specific deviations
- System
  - Kernel: enabled Multipath TCP (MPTCP) support in the kernel configuration
  - SSH: added 2FA support
  - WebUI: added 2FA support
  - WebUI: added dark theme
Improvements
- Network
  - Firewall: improved NAT offloading validation message in API
  - Network usage: improved "Total usage" data deletion funcionality
  - Realtime Traffic: improved performance when switching between time periods
  - Static Routes: added an enable switch to allow disabling routes
  - Wireless: added the ability to kick and block clients from the Status -> Wireless -> Interfaces page
  - Wireless: added disconnect reason to hostapd log
  - cURL: updated version to 8.19.0
- Services
  - Data to Server: added wildcard for mqtt topics
  - DMVPN: updated "Lifetime" and "IKE lifetime" fields and validations
  - Event juggler: added "Signal quality" event
  - I/O Status: added a switch component to the I/O Status table State column for state configuration
  - IPsec: added warning messages for insecure proposal options
  - Modbus Client: increased connection delay limits to 10s (10000ms)
  - Modbus TCP over Serial Gateway: added configurable inter-frame timeout for serial communication
  - SNMP: improved GSM signal strength trap with condition 'Less than', 'More than' and 'Range' triggers
  - SNMP: removed Events log signal strength trap - GSM signal strength trap should be used instead
  - SSTP: added connection status monitoring
  - TR-069: improved Device.WiFi.AccessPoint object based on "TR-181 Issue 2 Amendment 20", with implementation-specific deviations
  - TR-069: updated secure connection hint to inform that TLS works only when HTTPS is used
  - Net-SNMP: updated version to 5.9.5.2
- System
  - API Core: replaced Lua 5.1 with LuaJIT 2.1
  - Auto Reboot: updated abbreviated month and day names to full names for improved translation support
  - System Users: improved validation to allow usernames starting with numbers
  - Kernel: updated version to 6.6.126
Fix
- Network
  - Mobile: fixed a rare mobile application crash case when changing APN
  - MPLS: fixed package re-installation after updating with keep settings
  - Network: fixed protocol validation for LAN interfaces in API
  - Network: fixed interface deletion when page is not fully loaded
  - Network: fixed firewall zone select not showing VPN networks in LAN and WAN pages
  - Ports Settings: fixed being able to choose different link duplex mode when hardware doesn't allow
  - QOS: fixed connectivity issues when QoS is enabled
  - QOS: fixed an issue where settings were not correctly applied after saving
  - Realtime Traffic: fixed multiple plot rendering bugs related to daylight saving transitions
  - Wireless: fixed hostapd "no buffer space available" error with multiple SSIDs
  - Wireless: fixed SSID deletion when page is not fully loaded
  - Wireless: fixed DFS state handling after CAC end
- Services
  - Data to Server: fixed button positioning on smaller screens in configuration creation modal
  - Data to Server: fixed a rare case where stale data was sent via FTP after configuration changes
  - Data to Server: fixed FTP upload when the selected directory doesn't exist - now it is created if the FTP server allows it
  - Data to Server: fixed incorrect date formatting in GPS input plugin
  - DLMS: fixed database error in the API endpoint for database entries
  - DNP3 Client: fixed database error in the API endpoint for database entries
  - Email to SMS: fixed process hang in some rare cases
  - GPS: fixed segmentation fault in NTP GPS service after configuration update
  - Hotspot: fixed an issue where a hotspot instance appeared to be assigned to the wrong theme
  - I/O Status: fixed mismatched I/O pin names in the table and legend
  - I/O Status: fixed digital input/output pin re-initialization bug after using pulse counter
  - IEC 60870-5 Client: fixed common address validation on the client side
  - IEC 60870-5 Client: fixed database error in the API endpoint for database entries
  - IEC 60870-5 Server: fixed IEC60870-5 Server should not restart after disabling WAN access
  - Impulse Counter: fixed Impulse Counter add button tooltip to show a hint when all available options have been selected
  - IPsec: fixed hint overlap
  - L2TP: fixed validation requirements for client and server configurations
  - Mobile Utilities: fixed OpenVPN status SMS message
  - Modbus Client: fixed Modbus test button tooltips to display hints when testing
  - Modbus Client: fixed database error in the API endpoint for database entries
  - Modbus Client: fixed modbus client request configuration actions overflowing
  - OPC UA Client: fixed database error in the API endpoint for database entries
  - OPC UA Server: fixed error status not displaying messages
  - OpenConnect: fixed hint overlap
  - OpenVPN: fixed hint overlap
  - SNMP: fixed minor webui validation bug
  - TR-069: fixed OUI setting now it's dynamically set
- System
  - NTP Client: fixed unnecessary service restart when network interface changes state
  - Package Manager: fixed the installation of backup archive packages in cases of low free flash space
CVE Patches
- CVE-2025-13837 - 2.1 (LOW)
- CVE-2025-61099 - 7.5 (HIGH)
- CVE-2025-61100 - 7.5 (HIGH)
- CVE-2025-61101 - 7.5 (HIGH)
- CVE-2025-61102 - 7.5 (HIGH)
- CVE-2025-61103 - 7.5 (HIGH)
- CVE-2025-61104 - 7.5 (HIGH)
- CVE-2025-61105 - 7.5 (HIGH)
- CVE-2025-61106 - 7.5 (HIGH)
- CVE-2025-61107 - 7.5 (HIGH)
- CVE-2026-30874 - 1.8 (LOW)

RUTM_R_00.07.22.4 | 2026.06.12

Improvements
- System
  - Backup: restored backup generation to backup without API

RUTM_R_00.07.22.3 | 2026.05.19

Fix
- System
  - Backup: fixed saving of crontabs
CVE Patches
- CVE-2026-31431 - 7.8 (HIGH)
- CVE-2026-43284 - 7.8 (HIGH)

RUTM_R_00.07.22.1 | 2026.04.13

Improvements
- System
  - ustream-ssl: updated version to 2026-03-01
Fix
- Services
  - IEC 60870-5 Client: fixed missing serial support validation checks
  - IEC 60870-5 Server: fixed package dependency issues and missing serial support validation checks
  - Modbus Client: fixed test requests due to missing broadcast option
  - RMS: fixed configuration permission issues that caused connection problems
- System
  - Backup: fixed custom uci-default script execution
  - Backup: fixed ability to reset user password to device default password

RUTM_R_00.07.22 | 2026.03.25

New
- Network
  - SMCroute: added support
- Services
  - Data to Server: added webui option to toggle server certificate verification
  - DMVPN: added support for DMVPN configuration on GRE tunnels with IPv6 addressing
  - Events reporting: removed web user interface support
  - I/O Juggler: removed web user interface support
  - SNMP: added SNMP V3 users additional authentication types
- System
  - Integrity: added functionality to verify file system integrity
  - WebUI: added Polish language support
Improvements
- Network
  - DHCP server: added support for configuring multiple DHCP relay instances
  - DHCP server: added new DHCPv4 error status when parent interface has no IPv4 address
  - Dynamic routes: added mutual redirects between route status and dynamic route pages
  - Dynamic routes: improved display of OSPF routes
  - Dynamic routes: moved instance naming into edit modals for RIP
  - Firewall: improved performance across all firewall pages
  - Mobile: added a general signal quality metric, calculated from a combination of various mobile signal metrics
  - Network usage: added mutual redirects between "Connections" and "Network Usage" pages
  - Port Mirroring: added support for multiple mirror source ports
  - Ports Settings: added warning of enabled 802.1X ports
  - Starlink: added retrieval of location information
  - Wireless: enabled "Forward mesh peer traffic" by default on new mesh network
  - wireless-regdb: updated version to 2026.02.04
- Services
  - Auto Reply: added "Signal quality" parameter support
  - AWS IoT Core: added TPM support
  - Azure IoT Hub: added TPM support
  - BGP: added IPv6 support
  - BGP: moved instance naming into edit modals
  - Data to Server: added data compression
  - Data to Server: added TPM support
  - EoIP: added 'MTU' option
  - Event juggler: added HTTP URL scheme appendage if it is not defined in HTTP action
  - Event juggler: added TPM support
  - Event juggler: added "Signal quality" parameter support in output actions
  - Hotspot: reworked hotspot service
  - I/O Scheduler: removed ordinal suffixes from "From" and "To" table columns to improve localization
  - IEC 60870-5 Client: improved Information Objects tab usability and editing
  - IEC 60870-5 Client: added universal gateway support
  - IEC 60870-5 Server: added universal gateway support
  - IPsec: added additional proposal options
  - IPsec: removed duplicate proposals
  - IPsec: added automatic default route handling for route based IPsec
  - L2TPv3: improved "Cookie" and "Peer cookie" validation
  - Ledman: updated signal strength LED algorithm to use new value
  - Mobile Utilities: added "Signal quality" parameter support in status message
  - Modbus Client: added "Signal quality" parameter support in MQTT and Email actions
  - Modbus TCP over Serial Gateway: added function 43-14 (Read Device Identification) support
  - MQTT Broker: added certificate key length validation
  - MQTT Broker: added TPM support
  - MQTT Broker Bridge: added TPM support
  - MQTT Publisher: added TPM support
  - OpenVPN: improved server configuration when using a TAP device
  - OpenVPN: added 'Gateway IP address' option for bridged devices
  - PPTP: added client/server status information
  - Python3: reduced the Python package size by removing the python-unittest module
  - Python3: reduced package size by removing the "pydoc" module
  - RMS: updated the Connection Type field hint to reflect the current device connection frequency
  - SMPP: added TPM support
  - SNMP: added an option that makes ifIndex values persistent
  - Tailscale: added memory usage limitation option
  - TR-069: added input validations in set methods for nodes with read-write permissions
  - TR-069: added TR-143 based on "Issue 1 Amendment 1", with implementation-specific deviations
  - TR-069: improved Device.DHCPv4 object based on "TR-181 Issue 2 Amendment 20", with implementation-specific deviations
  - TR-069: added Device.Cellular object based on "TR-181 Issue 2 Amendment 20", with implementation-specific deviations
  - TR-069: added TPM support
  - Traffic Logging: added SFTP support for log uploading (with key support)
  - Traffic Logging: added FTPS support for log uploading
  - cURL: updated version to 8.18.0
  - EmailRelay: updated version to 2.5.2
  - FRR: updated version to 10.2.1
  - OpenVPN: updated version to 2.6.17
  - ovpn-dco: updated version to 0.2.20251017
  - Tailscale: updated version to 1.92.3
- System
  - Access Control: added SSH, telnet and WebUI session termination support
  - Backup: improved backup to use API endpoints
  - Speed Test: implemented filters and sorting for the servers table
  - glib2: updated version to 2.87.1
  - libmodbus: updated version to v3.1.11
  - openssl: updated version to 3.0.19
Fix
- Network
  - DHCP server: fixed DHCPv4 configuration page bug when parent interface has no IPv4 address
  - Topology: fixed lock functionality on touchscreen devices
  - Wireless: added an API error when multiple scans are performed at the same time
- Services
  - BACnet: fixed BBMD interface being immediately highlighted in red
  - BGP: fixed how neighborship is displayed for BGP when VRF is used
  - DLNA: fixed interface selection not showing WLAN interfaces that are not in any bridge
  - Email to SMS: fixed email deletion in some rare cases
  - EoIP: fixed issues with EoIP over L2TP configuration
  - Hotspot: fixed inconsistent session logout after disconnecting from wireless
  - IEC 60870-5 Client: fixed an issue where negative ASDU response results in a timeout
  - IEC 60870-5 Server: fixed server network not restarting after disabling “Allow remote access” when “Cyclic transmissions” are enabled
  - IEC 60870-5 Server: fixed flow control component placement to follow dependency order
  - IPsec: fixed IKEv1 allowing unsupported proposals
  - IPsec: fixed incorrectly applied offloading bypass rules
  - IPsec: fixed display of "Enable XAUTH" switch
  - Modbus Client: fixed service being launched without any requests to send
  - Modem Control: fixed devices that support CSD not being able to access CSD options
  - NTRIP: fixed issue where status fields were flashing stale data
  - OpenVPN: fixed learn-address routing to handle IPv4/IPv6
  - OSPF: fixed firewall rule creation
  - SMS Utilities: fixed "Switch WiFi on/off" action execution
  - SNMP: fixed Event type Topology change Trap
  - SNMP: fixed setting incorrect firewall rule family option
- System
  - NTP: fixed the NTP server due to invalid packet headers
  - Package Manager: fixed IPTables NAT Extras package not migrating when updating from RutOS 7.12
  - PAM: fixed TACACS+ WebUI remote host parameter
  - Troubleshoot: fixed duplicate devices listed in the TCP dump configuration
CVE Patches
- CVE-2025-11961 - 1.9 (LOW)
- CVE-2025-12084 - 6.3 (MEDIUM)
- CVE-2025-13836 - 9.1 (CRITICAL)

RUTM_R_00.07.21.3 | 2026.03.24

Fix
- System
  - Backup: fixed eSIM interface generation after uploading a backup
  - Reset Settings: fixed reset not responding

RUTM_R_00.07.21.2 | 2026.03.06

New
- Network
  - Mobile: added eSIM activation through proxy server
Improvements
- System
  - Site manager: added configurable DHCP option for client discovery
  - Site manager: added access control loss warning
Fix
- Network
  - Network: fixed an edge-case network hang after device reboot
- Services
  - Data to Server: fixed memory leak when using IEC 60870 5 as input and using output with custom format

RUTM_R_00.07.21.1 | 2026.02.26

Fix
- System
  - Site manager: fixed missing config files in SDK

RUTM_R_00.07.21 | 2026.02.17

New
- Network
  - Mobile: added "m2m" APN for "Spark M2M" operator to APN database
  - Mobile: added "iot" APN for "One NZ IOT" operator to APN database
  - MPLS: added LDP support
- System
  - PAM: added TACACS+ external user support
  - Site manager: added site manager functionality
Improvements
- Network
  - Firewall: added IPv6 masquerading support
  - Mobile: added SIM switch rule "On operator or country code"
  - Mobile: improved the default naming of network interfaces associated with eSIMs
  - Mobile: improved mobile data connection times on some cellular networks
  - Mobile: changed User Equipment Usage Setting to data centric mode
  - Network: added IPv4 subnet conflict warning and notification
  - Wireless: added WPA2-PPSK authentication support
  - ethtool: updated version to 6.15
  - Netifd: updated version to 2025-05-23
- Services
  - AWS IoT Core: added TPM support
  - BGP: added debug option
  - Data to Server: added TPM support
  - Data to Server: moved "Add new" button to table header for smaller screens
  - Data to Server: added failed MQTT messages count to MQTT server to restart broker connection when threshold is reached
  - DLMS: added options for configuring the logical and short name on a COSEM value
  - DLMS: improved test requests to not freeze when running many of them at the same time
  - Event juggler: added TPM support
  - Event juggler: moved "Add new" button to table header for smaller screens
  - Event juggler: added support for monitoring digital output pin state
  - IPsec: added ability to specify local and remote passthrough networks
  - IPsec: added Store keys in TPM toggle
  - Modbus Client: improved test requests to not freeze when running many of them at the same time
  - Modbus Client: added tolerance and tolerance timeout options for on-change storage with threshold comparisons and periodic refresh
  - MQTT Broker: added TPM support
  - MQTT Broker: updated TLS option names
  - MQTT Broker Bridge: updated TLS option names
  - MQTT Publisher: added TPM support
  - OPC UA Client: loosened data type validations, allowing more versatile data extraction
  - OPC UA Server: added support for configuring data sources, which allows exposing values from other services
  - OpenConnect: added Store keys in TPM toggle
  - OpenVPN: added support for generating client configuration from the server configuration
  - OpenVPN: added Store keys in TPM toggle
  - OSPF: added debug option
  - RIP: added debug option
  - SNMP: added multiple hosts support in Trap Settings
  - SNMP: added Data Source support
  - SNMP: added warning stating that selected Authentication type MD5 is not secure
  - SNMP: made SNMP community names hidden for unprivileged users
  - SSTP: added IPv6 support
  - Stunnel: added Store keys in TPM toggle
  - TR-069: added TLS and mTLS support
- System
  - CLI: added opkg notice about using third-party feeds
  - NTP Client: improved initial system time accuracy when "Save time to flash" is enabled
  - Update Firmware: split firmware update page to device and modem tabs
  - Update Firmware: added latest/stable firmware option in firmware page
  - WebUI: improved search performance
  - WebUI: expanded search function to include results from available to install packages in package manager
  - WebUI: updated footer design
  - WebUI: added footer customization options for GPL builds
  - Kernel: updated version to 6.6.119
Fix
- Network
  - DHCP server: added validation to prevent bridge and passthrough IP address usage for static leases
  - Mobile: fixed SIM PINs being kept in MNF when performing a factory reset with a SIM inserted
  - Multi AP: fixed incorrectly displayed access point enable switch state
  - Multi WAN: fixed failover not working after changing firewall settings
  - Network usage: fixed multiple issues that prevented the table from displaying
  - Static Routes: fixed applying static IPv6 routes after device restart
  - Wireless: fixed displaying associated client information when more than 270 clients are connected
- Services
  - Azure IoT Hub: fixed timed out message re-sending in some edge cases
  - Data to Server: fixed example Lua output script not working correctly with data containing double quotes
  - DLNA: fixed interfaces not having WLAN
  - DNP3 Outstation: fixed binary output status data type in outstation data sources
  - Dynamic DNS: fixed core handling of user input for 'cloudflare.com-v4'
  - Event juggler: fixed SMS action retry functionality not working in certain cases
  - Event juggler: fixed incorrect configuration parsing
  - GPS: fixed NTP GPS functionality
  - GRE: fixed state display when used with IPsec
  - Hotspot: fixed issues with download/upload limits
  - IEC 60870-5 Server: fixed validations when saving multiple configurations
  - IPsec: fixed firewall rule handling when instance is deleted
  - IPsec: fixed route based interface to be disabled when instance is disabled
  - IPsec: removed disabled state from "logs" and "active clients" when user has no write permissions
  - IPsec: fixed status endpoint to ignore zombie clients
  - IPsec: fixed DNS server update on connection
  - IPsec: fixed ID validation for API Post
  - Modbus Client: fixed Modbus write request function validation in Modbus TCP Client
  - Modbus Client: changed test requests to use the correct request ID
  - Modbus Client: fixed validation in Modbus Device requests, requests configuration now displays full function name
  - Modem Control: fixed flashing cached data when closing modal
  - NTRIP: fixed web interface to accept IPV6 addresses in server settings
  - OSPF: fixed interfaces not having WLAN
  - Package Manager: fixed removing orphan packages when any package dependency is not installed
  - RIP: fixed interfaces not having WLAN
  - RMS: fixed reconnection problem
  - RMS: fixed reconnection timer reset issue
  - SSTP: fixed address parsing when a URL protocol is used
  - SSTP: fixed adding routes to remote server
  - Wireguard: fixed startup after device reboot
  - Zerotier: fixed custom planet file permissions
- System
  - JSON-RPC: fixed permissions for "file" methods
  - Profiles: excluded Data Limit and IP Block databases from profiles
  - Update Firmware: fixed download from FOTA after cancelling firmware upload
  - WebUI: fixed styling of Format and Eject buttons in SD & USB Tools

RUTM_R_00.07.20.3 | 2026.01.23

Fix
- Services
  - Data to Server: fixed IEC 60870 data sender plugin failing to load

RUTM_R_00.07.20.1 | 2026.01.05

Fix
- System
  - Boot: fixed WAN ethernet led behaviour during boot on devices with specific hardware version
- Services
  - DDNS-scripts: improved core handling of user input

RUTM_R_00.07.20 | 2025.12.16

New
- Network
  - Mobile: added "mobileinternet.tele2.lt" APN for "Tele2" operator to APN database
  - Wireless: added support for a global installation type option for radio devices
- Services
  - Data to Server: added IEC 60870-5 Client as an input
  - IEC 60870-5 Client: added IEC 60870-5-104 Client
  - IEC 60870-5 Server: added IEC101 and IEC104 support
- System
  - Package Manager: added CIFS/SMBFS filesystem support
Improvements
- Network
  - 802.1X Client: updated 802.1x validation so that 802.1x client can no longer be enabled on a port that is disabled
  - 802.1X Server: updated 802.1x validation so that 802.1x server can no longer be enabled on a port that is disabled
  - DHCP server: improved "DHCPv6-Mode" field's option names and hints
  - Mobile: improved log message when no primary SIM is set
  - Mobile: improved DFOTA log message when checking for updates
  - Mobile: added "Switch to next SIM" button in 'Status -> Mobile' page
  - Mobile: improved mobile data connection establishment time
  - Mobile: improved mobile connection bring up behavior when the "Service option not subscribed" error is received
  - Multi WAN: added IPv4 and IPv6 WAN interface coexistence warning
  - Network: improved "Force link" field hint
  - Network: fixed "Force link" field to respect default value when changing interface protocol
  - SSHFS: updated setting fields to be shown when service is disabled
  - SSHFS: added directory as prefix to "Mount point" field
  - ethtool: updated version to 6.10
- Services
  - AWS IoT Core: updated orange error status to be red
  - Azure IoT Hub: updated status columns to use text badges instead of circle icons
  - Data to Server: updated input sections to be toggleable
  - Data to Server: added certificates to global certificate manager
  - Data to Server: increased the limit for Modbus data filtering entries
  - Event juggler: added certificates to global certificate manager
  - I/O Juggler: added certificates to global certificate manager
  - I/O Status: moved all custom I/O configuration from table to the edit
  - I/O Status: updated all I/O pinout and Power pinout icons
  - L2TP: improved adding custom options to the configuration

- - MQTT Broker: added certificates to global certificate manager
  - MQTT Broker Bridge: added certificates to global certificate manager
  - MQTT Publisher: added certificates to global certificate manager
  - SD & USB Tools: added additional mounting behavior options
  - SMPP: added certificates to global certificate manager
  - SNMP: added additional info to Trap message
- System
  - Certificates: changed SCEP enrollment to try AES first and fall back to 3DES
  - RutOS: updated login banner to include internal API usage
  - Kernel: updated version to 6.6.115
Fix
- Network
  - 802.1X Client: fixed incorrectly displaying port link state
  - Firewall: removed low contrast zone colors
  - Mobile: fixed SMS Limit excessive logging
  - Network: fixed PPPoE client options not being removed after switching to other protocol
  - Network: fixed routing table rules not matching interface metric order
  - Realtime Traffic: fixed traffic history not showing up in some cases
  - Realtime Traffic: fixed plot background rendering when switching between plots
  - Realtime Traffic: fixed plot popover position on Firefox 143 and later
  - Wireless: fixed latency spikes after wireless roam
  - Wireless: fixed authentication timeout during fast transition
  - Wireless: fixed retrieving empty cached wireless scan results
- Services
  - Azure IoT Hub: fixed empty status hint
  - DNP3 Client: fixed display issues with long request names
  - DNP3 Outstation: fixed display issues with long request names
  - Dynamic DNS: fixed bind-nsupdate method not working on multi-level subdomains
  - Event juggler: fixed HTTP action request type
  - Hotspot: fixed session data delete when deleting user
  - L2TP: fixed log display in WebUI
  - Modbus Client: fixed duplicate query parameters validation in database entries endpoint
  - Modbus Client: fixed display issues with long request names
  - Modbus Server: fixed display issues with long request names
  - MQTT Broker: fixed 'Allow persistence' option
  - OPC UA Client: fixed duplicate query parameters validation in database entries endpoint
  - OPC UA Client: fixed API error when 'server_node' option had an incorrect type in group values test endpoint
  - OpenVPN: fixed status in Static Key Authentication mode
  - OpenVPN: fixed handling of 'user' and 'group' parameters
  - RMS: fixed connection status jumping between "Connecting" and "Connected" states
  - SD & USB Tools: fixed API error when 'fs' option was not provided for safe_remove, format endpoints
  - SMS Utilities: fixed script action execution when arguments are provided
- System
  - Certificates: fixed importing DER keys to TPM
  - RutOS: fixed rare UCI deadlock causing system hangs
  - Speed Test: fixed selecting WAN interface when using servers with IPv6 support
  - System Users: fixed redundant /etc/group member creation
  - WebUI: fixed target area that triggers hint text
CVE Patches
- CVE-2025-46394 - 3.3 (LOW)

RUTM_R_00.07.19.6 | 2025.12.10

Fix
- Network
  - Mobile: fixed SIM card state being falsely reported as inserted

RUTM_R_00.07.19.3 | 2025.11.26

Initial firmware release