MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation.
This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 7
https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
cvd@cert.pl
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-…
cvd@cert.pl
https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802
cvd@cert.pl
https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801
cvd@cert.pl
https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800
cvd@cert.pl
https://mikrotik.com/supportsec/september-2026-vulnerability/
cvd@cert.pl
https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-t…
cvd@cert.pl