Critical security vulnerabilities found in MikroTik RouterOS

oloke

On September 5th, CERT Polska published multiple CVEs affecting MikroTik's RouterOS. MikroTik has also published an official vulnerability notice a few days prior.

The discovered security issues enable a remote attacker to gain shell access (ssh service), read arbitrary files (webfig service) or cause service disruption via DoS (btest service).
Below the description of discovered CVEs from cert.pl:

CVE-2026-67276 - SSH authentication bypass (CVSS: 9.2)
RouterOS did not properly verify public keys used for SSH authentication - in particular, it did not compare the entire RSA public key assigned to a user. An attacker who knew the username and the public modulus of the user's key could craft a different key and log in via SSH without possessing the corresponding private key. The privileges obtained were equivalent to those of the targeted account.

CVE-2026-86060 - SSH session privilege manipulation via a crafted username (CVSS: 9.2)
RouterOS did not properly handle usernames beginning with a disallowed character in the SSH login mechanism. By using a crafted username, an attacker could elevate their privileges. The resulting session had full administrative privileges in the RouterOS system.

CVE-2026-67277 - memory disclosure and crash via bandwidth-test (CVSS: 8.8)
The bandwidth-test service allowed an unauthenticated connection to enter a state that should only be reachable after logging in. Combined with two separate flaws - disclosure of uninitialized data from the packet buffer and an integer underflow in size validation - this enabled kernel memory leakage or a remote DoS attack leading to a system restart.

The vulnerabilities have already been found to be exploited in the wild, if you run MikroTik RouterOS anywhere, it's necessary to upgrade to patched versions.
Those are currently: 7.25beta3 (Beta), v7.24.2 (Stable), v7.23.4 (Long-term), v6.49.21 (Long-term v6).

MannDude

  MMM      MMM       KKK                          TTTTTTTTTTT      KKK
  MMMM    MMMM       KKK                          TTTTTTTTTTT      KKK
  MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO      TTT     III  KKK  KKK
  MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO     TTT     III  KKKKK
  MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO     TTT     III  KKK KKK
  MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO      TTT     III  KKK  KKK

  MikroTik RouterOS 7.24.2 (c) 1999-2026       https://www.mikrotik.com/


Press F1 for help

(Used for some wonky anycast stuff)

david3

I use a Mikrotik at home. I got an update notification in winbox (the router management interface) 2 days ago and updated. Its the first time I've seen an update notification pushed like that.

eezcloud

Currently feeling very happy that our Mikrotik ssh is behind Wireguard.

yoursunny

Excerpt from Route48 Terms of Service:
Mikrotik is garbage.