Routeros
Monthly
Session token replay in the WebFig management interface of MikroTik RouterOS (through 7.24.5) lets an attacker who already possesses a captured administrator session token bypass authentication and gain persistent administrative access, because tokens stay valid across newly negotiated ECDH sessions until the device's login store is explicitly cleared. The 9.1 CVSS v4 score reflects high confidentiality and integrity impact, but its AC:H rating is meaningful: the attacker must first obtain a valid token out-of-band, for example through the unfixed transport-layer exposure described in CVE-2025-61481, and no user interaction is needed once a token is held. No public exploit identified at time of analysis and no CISA KEV entry exists; devices whose WebFig interface is not reachable from untrusted networks are not realistically exposed.
Integer overflow in MikroTik RouterOS firewall SAME-target handling can crash or brick affected routers when an authenticated user with firewall/NAT rule privileges installs a manipulated ipt_SAME rule. The flaw affects RouterOS through 6.40.5, 6.44, and 7.20.8, with fixes in 7.21.5 and 7.23.1. No CISA KEV listing was provided and no public exploit was confirmed at time of analysis; the assessed impact is availability-only.
An incorrect authorization flaw in the WinBox authentication flow of MikroTik RouterOS lets a remote authenticated attacker who holds valid credentials for a low-privilege, WinBox-permitted account take over the authorization policy of a different, higher-privileged account such as admin. The EC-SRP stage-one challenge and proof are validated against the attacker's own account, but the separately supplied stage-two username determines which privilege policy gets installed, so the attacker ends up with a full administrative session without ever knowing the admin password, and can then use it to elevate their own account. Coverage across ENISA and CERT.LV reporting with a CVSS 4.0 score of 8.7 indicates a high-severity, network-reachable issue; no public exploit code has been identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires one valid low-privilege WinBox-enabled credential and network reachability to the WinBox service.
Unauthenticated remote code execution in MikroTik RouterOS allows a network attacker who can reach the built-in web management service (WebFig / HTTP admin interface) to run arbitrary code as root, or to crash the device, with a single crafted request against the service's HTTP request-body handling. The defect is an integer underflow in that parsing path that is reachable before authentication, so no credentials, user interaction, or special privileges are needed on unpatched releases (RouterOS before 7.24). A vendor patch is available in 7.24, no public exploit identified at time of analysis, and the decisive real-world factor is whether the web management service is exposed to untrusted networks, since this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.
Denial of service in MikroTik RouterOS: an on-path attacker able to inject a BGP UPDATE into an established session can crash the device's BGP routing service with a single malformed MP_REACH_NLRI UPDATE whose labelled-VPN NLRI carries a prefix-length below the minimum valid value. Affected are RouterOS builds before 7.25beta4 that run the routing/BGP service with the labelled-VPN VPNv4 or VPNv6 address family enabled; the malformed route passes NLRI validation, describes an address portion of negative length, terminates the session without a NOTIFICATION, and can be resent to hold down the BGP plane indefinitely. The exploit requires a peer or man-in-the-middle position on the peering link rather than arbitrary off-path internet access, no public exploit code was identified at time of analysis, and the vendor has released a fix in the 7.25beta4 development build.
Heap memory corruption in the userspace SMB daemon of MikroTik RouterOS before 7.24 lets remote, unauthenticated attackers crash or destabilize the service by sending a crafted SMB1 SessionSetupAndX request whose uniPwdLen field triggers an integer underflow and an oversized copy into a smaller heap buffer (CWE-122). The independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as an availability-only impact - adjacent heap corruption in a userspace daemon, not a confirmed path to code execution - and the primary limiting factor is that the SMB service is not enabled by default on RouterOS. No public exploit code has been identified at time of analysis, and exploitation requires the SMB service to be enabled and network-reachable with legacy SMB1 dialect handling active; a vendor fix shipped in RouterOS 7.24.
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite the trusted RouterOS policy mask by supplying a username that begins with a prohibited character. Because the flaw is reached before authentication completes, an attacker who can open an SSH session to an affected device can escalate to full administrative privileges. Publicly available exploit code exists, and CERT-PL (the reporter) has published a companion advisory describing these RouterOS issues as actively exploited, though the CVE is not confirmed on CISA KEV in the provided data.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stores - to any network attacker who can reach the management interface. The vulnerability chains an uninitialized principal pointer (CWE-824) in /jsproxy session allocation with an encrypted URI path traversal, allowing pre-authentication escalation of file-read rights followed by namespace escape. Fixed versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable) are available; a public exploit writeup exists, and CERT-PL's September 2026 reporting references active exploitation of this class of MikroTik vulnerabilities.
SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-authentication phase by triggering a client-requested rekey, causing the server to advance directly into the connection protocol and accept session channel and exec requests. The result is unauthenticated file creation, overwrite, and exfiltration within the RouterOS managed file namespace - including support bundles containing configuration and diagnostic data. Publicly available exploit code exists, CERT-PL has published dedicated research, and a companion CERT-PL post titled 'vulnerabilities-in-mikrotik-routeros-actively-exploited' suggests observed exploitation in the wild, though CISA KEV listing is not confirmed in the available data.
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: kernel memory disclosure and kernel crash/restart. The btest server accepts a 'related' secondary UDP connection before the primary TCP control session completes authentication, permitting a pre-auth attacker to drive the btest data path. With random-data=false, the kernel transmits uninitialized packet buffer contents to the attacker; a separate unchecked inverted packet-size interval triggers unsigned integer underflow producing anomalously large fragmented output that crashes the RouterOS kernel. CERT-PL reported this vulnerability and a CERT-PL advisory titled 'actively exploited' indicates in-the-wild use, though CISA KEV confirmation is absent from available data; a public exploit and binary reverse-engineering write-up are available.
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user by exploiting incomplete RSA public-key comparison. During public-key auth RouterOS matches only the key type and modulus and ignores the exponent, so an attacker who knows an authorized user's RSA modulus can submit a key with exponent 1, forge a signature the server will validate, and open a command channel without the private key. Publicly available exploit code exists (reverse-engineered from the silent patch), and CERT-PL - the reporting party - describes the RouterOS vulnerabilities as being actively exploited, though this CVE is not confirmed in CISA KEV from the provided data.
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An out-of-bounds read in the userspace SMB daemon of MikroTik RouterOS before 7.24 allows unauthenticated remote attackers to read memory beyond the end of the request buffer by sending a minimal SMB1 SessionSetupAndX frame with a crafted uniPwdLen field value. The over-read occurs in the SessionSetupAndX handler before any credential validation, so no authentication or user interaction is required, though exploitation is only possible when the non-default SMB service is enabled and reachable on the network. Vendor-released patch: RouterOS 7.24; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the independent assessment rates the impact as limited memory disclosure (VC:L) with possible service disruption (VA:L) rather than code execution or full memory disclosure.
Path traversal in MikroTik RouterOS's container package OCI/tar image extraction enables an authenticated administrator to be induced into importing a crafted container image that writes arbitrary files outside the container root onto the device's persistent data partition with root privileges. The vulnerability fires entirely at import time via the `/container/add` endpoint - the container never needs to start - enabling file creation, deletion via overlayfs whiteout, directory creation, and hardlink creation on the host filesystem. No public exploit has been identified and SSVC rates exploitation as none, but the 7.23.x long-term branch remains unpatched indefinitely, with container-7.23.3.npk and container-7.23.4.npk confirmed byte-identical.
Stack-based buffer overflow in MikroTik RouterOS's mtget binary TFTP RRQ builder allows any authenticated user, including those with only read-only group membership, to crash the mtget worker process by issuing a /tool fetch command with a crafted tftp:// URL path of 507 bytes or more. The overflow involves an unbounded rep movsb instruction that overwrites saved registers at a deterministic stack offset, causing a reproducible process crash without requiring network connectivity to an actual TFTP server. No public exploit code has been identified at time of analysis, and vendor patches are available in RouterOS 7.23.4 (long-term) and 7.24.2 (stable).
TLS server impersonation in MikroTik RouterOS is enabled by improper RSA/PKCS#1 v1.5 signature verification that fails to reject malformed signatures produced via cube-root forgery against an e=3 root CA already present in the router's trust store. An attacker positioned to intercept outbound RouterOS TLS sessions can forge a trusted intermediate CA certificate - using only the root CA's public certificate, without its private key - and issue leaf certificates for arbitrary hostnames, fully impersonating TLS servers the router connects to. A publicly available exploit exists based on CERT-PL research and independent reverse-engineering of the 7.23.4 silent patch; vendor-released patches are available across all supported branches.
Insufficient session expiration in the MikroTik RouterOS API allows authenticated users whose permissions have been reduced to retain their prior, elevated access rights for the duration of the stale session. Specifically, when a user's group membership or permission set is downgraded, or when an inactivity timeout is expected to expire a session, the RouterOS API fails to re-evaluate or invalidate the existing session token - exposing confidential routing, firewall, or credential data the user should no longer reach. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; however, ICS-CERT's publication of ICSA-26-211-01 signals elevated concern for operational technology networks where MikroTik devices are used for segmentation and industrial network management.
RouterOS fails to properly validate certificate scope across its shared system certificate store, allowing any trusted certificate authority to authenticate in contexts beyond its intended scope. This vulnerability enables partial or full authentication bypass in OpenVPN, CAPsMAN, and 802.1X (Dot1x) services, affecting all RouterOS versions that use the vulnerable shared certificate validation logic. The vulnerability requires network access but no user interaction or authentication, making it remotely exploitable against default configurations.
CVE-2025-6443 is an unauthenticated remote access control bypass vulnerability in Mikrotik RouterOS affecting VXLAN traffic handling. The vulnerability allows remote attackers to bypass ingress filtering and gain unauthorized access to internal network resources by exploiting improper validation of remote IP addresses in VXLAN packets. With a CVSS score of 7.2 (Network-based, Low complexity, No privileges required) and unauthenticated exploitation capability, this vulnerability presents a significant risk to exposed RouterOS deployments, particularly those utilizing VXLAN for network segmentation.
MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An array index error in MikroTik RouterOS 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5, allows an unauthenticated remote attacker to crash the SMB server via modified setup-request packets, aka. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of uncontrolled resource. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in MikroTik RouterOS 6.41.4. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability in MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of UDP packets on port 500 (used for L2TP over IPsec), preventing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of TCP RST packets,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 21.2%.
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 18.1%.
The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consumption), read the router version, and possibly have other impacts via a request. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Session token replay in the WebFig management interface of MikroTik RouterOS (through 7.24.5) lets an attacker who already possesses a captured administrator session token bypass authentication and gain persistent administrative access, because tokens stay valid across newly negotiated ECDH sessions until the device's login store is explicitly cleared. The 9.1 CVSS v4 score reflects high confidentiality and integrity impact, but its AC:H rating is meaningful: the attacker must first obtain a valid token out-of-band, for example through the unfixed transport-layer exposure described in CVE-2025-61481, and no user interaction is needed once a token is held. No public exploit identified at time of analysis and no CISA KEV entry exists; devices whose WebFig interface is not reachable from untrusted networks are not realistically exposed.
Integer overflow in MikroTik RouterOS firewall SAME-target handling can crash or brick affected routers when an authenticated user with firewall/NAT rule privileges installs a manipulated ipt_SAME rule. The flaw affects RouterOS through 6.40.5, 6.44, and 7.20.8, with fixes in 7.21.5 and 7.23.1. No CISA KEV listing was provided and no public exploit was confirmed at time of analysis; the assessed impact is availability-only.
An incorrect authorization flaw in the WinBox authentication flow of MikroTik RouterOS lets a remote authenticated attacker who holds valid credentials for a low-privilege, WinBox-permitted account take over the authorization policy of a different, higher-privileged account such as admin. The EC-SRP stage-one challenge and proof are validated against the attacker's own account, but the separately supplied stage-two username determines which privilege policy gets installed, so the attacker ends up with a full administrative session without ever knowing the admin password, and can then use it to elevate their own account. Coverage across ENISA and CERT.LV reporting with a CVSS 4.0 score of 8.7 indicates a high-severity, network-reachable issue; no public exploit code has been identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning exploitation requires one valid low-privilege WinBox-enabled credential and network reachability to the WinBox service.
Unauthenticated remote code execution in MikroTik RouterOS allows a network attacker who can reach the built-in web management service (WebFig / HTTP admin interface) to run arbitrary code as root, or to crash the device, with a single crafted request against the service's HTTP request-body handling. The defect is an integer underflow in that parsing path that is reachable before authentication, so no credentials, user interaction, or special privileges are needed on unpatched releases (RouterOS before 7.24). A vendor patch is available in 7.24, no public exploit identified at time of analysis, and the decisive real-world factor is whether the web management service is exposed to untrusted networks, since this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case.
Denial of service in MikroTik RouterOS: an on-path attacker able to inject a BGP UPDATE into an established session can crash the device's BGP routing service with a single malformed MP_REACH_NLRI UPDATE whose labelled-VPN NLRI carries a prefix-length below the minimum valid value. Affected are RouterOS builds before 7.25beta4 that run the routing/BGP service with the labelled-VPN VPNv4 or VPNv6 address family enabled; the malformed route passes NLRI validation, describes an address portion of negative length, terminates the session without a NOTIFICATION, and can be resent to hold down the BGP plane indefinitely. The exploit requires a peer or man-in-the-middle position on the peering link rather than arbitrary off-path internet access, no public exploit code was identified at time of analysis, and the vendor has released a fix in the 7.25beta4 development build.
Heap memory corruption in the userspace SMB daemon of MikroTik RouterOS before 7.24 lets remote, unauthenticated attackers crash or destabilize the service by sending a crafted SMB1 SessionSetupAndX request whose uniPwdLen field triggers an integer underflow and an oversized copy into a smaller heap buffer (CWE-122). The independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as an availability-only impact - adjacent heap corruption in a userspace daemon, not a confirmed path to code execution - and the primary limiting factor is that the SMB service is not enabled by default on RouterOS. No public exploit code has been identified at time of analysis, and exploitation requires the SMB service to be enabled and network-reachable with legacy SMB1 dialect handling active; a vendor fix shipped in RouterOS 7.24.
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite the trusted RouterOS policy mask by supplying a username that begins with a prohibited character. Because the flaw is reached before authentication completes, an attacker who can open an SSH session to an affected device can escalate to full administrative privileges. Publicly available exploit code exists, and CERT-PL (the reporter) has published a companion advisory describing these RouterOS issues as actively exploited, though the CVE is not confirmed on CISA KEV in the provided data.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stores - to any network attacker who can reach the management interface. The vulnerability chains an uninitialized principal pointer (CWE-824) in /jsproxy session allocation with an encrypted URI path traversal, allowing pre-authentication escalation of file-read rights followed by namespace escape. Fixed versions 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable) are available; a public exploit writeup exists, and CERT-PL's September 2026 reporting references active exploitation of this class of MikroTik vulnerabilities.
SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-authentication phase by triggering a client-requested rekey, causing the server to advance directly into the connection protocol and accept session channel and exec requests. The result is unauthenticated file creation, overwrite, and exfiltration within the RouterOS managed file namespace - including support bundles containing configuration and diagnostic data. Publicly available exploit code exists, CERT-PL has published dedicated research, and a companion CERT-PL post titled 'vulnerabilities-in-mikrotik-routeros-actively-exploited' suggests observed exploitation in the wild, though CISA KEV listing is not confirmed in the available data.
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: kernel memory disclosure and kernel crash/restart. The btest server accepts a 'related' secondary UDP connection before the primary TCP control session completes authentication, permitting a pre-auth attacker to drive the btest data path. With random-data=false, the kernel transmits uninitialized packet buffer contents to the attacker; a separate unchecked inverted packet-size interval triggers unsigned integer underflow producing anomalously large fragmented output that crashes the RouterOS kernel. CERT-PL reported this vulnerability and a CERT-PL advisory titled 'actively exploited' indicates in-the-wild use, though CISA KEV confirmation is absent from available data; a public exploit and binary reverse-engineering write-up are available.
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user by exploiting incomplete RSA public-key comparison. During public-key auth RouterOS matches only the key type and modulus and ignores the exponent, so an attacker who knows an authorized user's RSA modulus can submit a key with exponent 1, forge a signature the server will validate, and open a command channel without the private key. Publicly available exploit code exists (reverse-engineered from the silent patch), and CERT-PL - the reporting party - describes the RouterOS vulnerabilities as being actively exploited, though this CVE is not confirmed in CISA KEV from the provided data.
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An out-of-bounds read in the userspace SMB daemon of MikroTik RouterOS before 7.24 allows unauthenticated remote attackers to read memory beyond the end of the request buffer by sending a minimal SMB1 SessionSetupAndX frame with a crafted uniPwdLen field value. The over-read occurs in the SessionSetupAndX handler before any credential validation, so no authentication or user interaction is required, though exploitation is only possible when the non-default SMB service is enabled and reachable on the network. Vendor-released patch: RouterOS 7.24; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the independent assessment rates the impact as limited memory disclosure (VC:L) with possible service disruption (VA:L) rather than code execution or full memory disclosure.
Path traversal in MikroTik RouterOS's container package OCI/tar image extraction enables an authenticated administrator to be induced into importing a crafted container image that writes arbitrary files outside the container root onto the device's persistent data partition with root privileges. The vulnerability fires entirely at import time via the `/container/add` endpoint - the container never needs to start - enabling file creation, deletion via overlayfs whiteout, directory creation, and hardlink creation on the host filesystem. No public exploit has been identified and SSVC rates exploitation as none, but the 7.23.x long-term branch remains unpatched indefinitely, with container-7.23.3.npk and container-7.23.4.npk confirmed byte-identical.
Stack-based buffer overflow in MikroTik RouterOS's mtget binary TFTP RRQ builder allows any authenticated user, including those with only read-only group membership, to crash the mtget worker process by issuing a /tool fetch command with a crafted tftp:// URL path of 507 bytes or more. The overflow involves an unbounded rep movsb instruction that overwrites saved registers at a deterministic stack offset, causing a reproducible process crash without requiring network connectivity to an actual TFTP server. No public exploit code has been identified at time of analysis, and vendor patches are available in RouterOS 7.23.4 (long-term) and 7.24.2 (stable).
TLS server impersonation in MikroTik RouterOS is enabled by improper RSA/PKCS#1 v1.5 signature verification that fails to reject malformed signatures produced via cube-root forgery against an e=3 root CA already present in the router's trust store. An attacker positioned to intercept outbound RouterOS TLS sessions can forge a trusted intermediate CA certificate - using only the root CA's public certificate, without its private key - and issue leaf certificates for arbitrary hostnames, fully impersonating TLS servers the router connects to. A publicly available exploit exists based on CERT-PL research and independent reverse-engineering of the 7.23.4 silent patch; vendor-released patches are available across all supported branches.
Insufficient session expiration in the MikroTik RouterOS API allows authenticated users whose permissions have been reduced to retain their prior, elevated access rights for the duration of the stale session. Specifically, when a user's group membership or permission set is downgraded, or when an inactivity timeout is expected to expire a session, the RouterOS API fails to re-evaluate or invalidate the existing session token - exposing confidential routing, firewall, or credential data the user should no longer reach. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; however, ICS-CERT's publication of ICSA-26-211-01 signals elevated concern for operational technology networks where MikroTik devices are used for segmentation and industrial network management.
RouterOS fails to properly validate certificate scope across its shared system certificate store, allowing any trusted certificate authority to authenticate in contexts beyond its intended scope. This vulnerability enables partial or full authentication bypass in OpenVPN, CAPsMAN, and 802.1X (Dot1x) services, affecting all RouterOS versions that use the vulnerable shared certificate validation logic. The vulnerability requires network access but no user interaction or authentication, making it remotely exploitable against default configurations.
CVE-2025-6443 is an unauthenticated remote access control bypass vulnerability in Mikrotik RouterOS affecting VXLAN traffic handling. The vulnerability allows remote attackers to bypass ingress filtering and gain unauthorized access to internal network resources by exploiting improper validation of remote IP addresses in VXLAN packets. With a CVSS score of 7.2 (Network-based, Low complexity, No privileges required) and unauthenticated exploitation capability, this vulnerability presents a significant risk to exposed RouterOS deployments, particularly those utilizing VXLAN for network segmentation.
MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An array index error in MikroTik RouterOS 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5, allows an unauthenticated remote attacker to crash the SMB server via modified setup-request packets, aka. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized connections, and cause a reboot via connect and write. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot because of uncontrolled resource. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote directory traversal via the HTTP or. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory corruption vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a memory exhaustion vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in MikroTik RouterOS 6.41.4. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability in MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of UDP packets on port 500 (used for L2TP over IPsec), preventing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all available CPU via a flood of TCP RST packets,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 21.2%.
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 18.1%.
The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consumption), read the router version, and possibly have other impacts via a request. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.