CVE-2026-67278
Received Received - Intake

RSA Signature Forgery in MikroTik RouterOS

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: CERT.PL

Description
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-06
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-67278
EUVD
EUVD-2026-72026

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mikrotik routeros to 6.49.21 (inc)
mikrotik routeros to 7.23.4 (inc)
mikrotik routeros to 7.24.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MikroTik RouterOS has a flaw where it accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 certificate validation. Because the trust store includes a root CA with a public exponent of 3, an attacker can forge trusted intermediate certificates and issue certificates for any hostname without needing the root CA's private key. This allows TLS server impersonation for outbound RouterOS TLS connections.

Impact Analysis

This vulnerability enables attackers to impersonate trusted servers during TLS connections initiated by MikroTik RouterOS devices. If exploited, it could allow interception of sensitive data, such as login credentials or other confidential information, transmitted through these connections.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected MikroTik RouterOS versions may fail to meet compliance standards due to insufficient protection against TLS impersonation attacks.

Mitigation Strategies

Upgrade MikroTik RouterOS to version 6.49.21, 7.23.4, or 7.24.2 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67278. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart