CVE-2026-67278mediumCWE-347

CVE-2026-67278: fallo de gravedad media en Mikrotik RouterOS

TLS server impersonation possible in Mikrotik RouterOS

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear RouterOS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 6.3epss 0.3%
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication. This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
Mikrotik · RouterOS
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Mikrotik RouterOS

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-86060CRITICALSSH session privilege manipulation via a crafted username in Mikrotik RouterOSEPSS 6.4%KEVCVE-2026-67279MEDIUMSSH Pre-Authentication Rekey State Bypass in MikroTik RouterOSEPSS 2.3%KEVCVE-2026-67277HIGHKernel memory disclosure and denial of service in MikroTik RouterOS btest serviceEPSS 1.6%KEVCVE-2026-67276CRITICALSSH user impersonation possible in Mikrotik RouterOSEPSS 8.9%CVE-2026-67281HIGHUnauthenticated file read in Mikrotik RouterOSEPSS 0.7%CVE-2023-32154HIGHMikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution VulnerabilityEPSS 0.6%