Skip to content
VulniPulse
Sign in
Advisory severityMedium6.3MikroTik Updated

Medium [CVE-2026-67278] MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication

This medium-severity MikroTik advisory covers CVE-2026-67278 affecting MikroTik RouterOS.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-67278 Source published Source updated

VulniPulse record published Record updated

CVE-2026-67278
Affected products & platforms
MikroTikRouterOS
Open source advisory

Android app · Google Play

Monitor future MikroTik CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication.

Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation.

The same permissive verification also undermines RSA-based SSH authentication.

This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.

Affected versions
  • RouterOS 7.24 before 7.24.2
  • RouterOS 7.0.0 before 7.23.4
  • RouterOS 6.0.0 before 6.49.21

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

Fixed versions
  • 7.23.6
  • 7.24.3

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

Mitigation

Upgrade to a fixed release: 7.23.6, 7.24.3. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.