Mikrotik

Routeros

91 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.9

CVE-2026-14227

  • EPSS 0.22%
  • Veröffentlicht 30.07.2026 17:39:59
  • Zuletzt bearbeitet 30.07.2026 20:16:52

An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or...

8.8

CVE-2026-16347

  • EPSS 0.23%
  • Veröffentlicht 28.07.2026 19:59:29
  • Zuletzt bearbeitet 30.07.2026 14:12:18

MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing r...

7.5

CVE-2026-39042

  • EPSS 0.2%
  • Veröffentlicht 13.07.2026 00:00:00
  • Zuletzt bearbeitet 15.07.2026 20:27:37

An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten() function in libumsg.so.

7.5

CVE-2024-27686

  • EPSS 0.59%
  • Veröffentlicht 08.05.2026 00:00:00
  • Zuletzt bearbeitet 08.05.2026 16:02:14

Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445.

6.5

CVE-2025-42611

  • EPSS 0.19%
  • Veröffentlicht 05.05.2026 11:16:31
  • Zuletzt bearbeitet 07.05.2026 14:51:53

RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications. This includes OpenVPN, CAPsMAN, Dot1x (802.1X), among others. The vulnerability lies ...

7.5

CVE-2026-7668

Exploit
  • EPSS 0.3%
  • Veröffentlicht 02.05.2026 20:00:15
  • Zuletzt bearbeitet 20.05.2026 08:16:23

A vulnerability was identified in MikroTik RouterOS 6.49.8. This vulnerability affects the function ASN1_STRING_data in the library nova/lib/www/scep.p of the component SCEP Endpoint. The manipulation of the argument transactionID/messageType leads t...

10

CVE-2025-61481

  • EPSS 0.28%
  • Veröffentlicht 27.10.2025 00:00:00
  • Zuletzt bearbeitet 15.04.2026 00:35:42

An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials.

9

CVE-2025-10948

  • EPSS 0.72%
  • Veröffentlicht 25.09.2025 14:15:43
  • Zuletzt bearbeitet 15.04.2026 00:35:42

A vulnerability has been found in MikroTik RouterOS 7. This affects the function parse_json_element of the file /rest/ip/address/print of the component libjson.so. The manipulation leads to buffer overflow. The attack is possible to be carried out re...

4.8

CVE-2025-6563

  • EPSS 0.64%
  • Veröffentlicht 03.07.2025 11:18:26
  • Zuletzt bearbeitet 15.04.2026 00:35:42

A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS...

6.5

CVE-2023-47310

  • EPSS 0.2%
  • Veröffentlicht 30.06.2025 00:00:00
  • Zuletzt bearbeitet 05.07.2026 16:18:32

A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP traceroute packets.