Advisories · Technology
MikroTik RouterOS.
Every CVE that names MikroTik RouterOS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
- MikroTik RouterOS
- Authentication bypass
- CVSS 7.1 High
MikroTik RouterOS ipt_SAME.ko same_check integer overflow
- MikroTik RouterOS
- Memory corruption
- CWE-189
- CVSS 8.7 High
MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation
- MikroTik RouterOS
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
MikroTik RouterOS Integer Underflow
- MikroTik RouterOS
- Memory corruption
- CVSS 8.7 High
MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI
- MikroTik RouterOS
- CWE-1284
- CVSS 8.2 High
MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX
- MikroTik RouterOS
- Memory corruption
- CVSS 6.3 Medium
MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX
- MikroTik RouterOS
- Memory corruption
- CVSS 6.9 Medium
MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction
- MikroTik RouterOS
- Path traversal
- CVSS 5.3 Medium
MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path
- MikroTik RouterOS
- Memory corruption
- CVSS 9.2 CriticalCritical · KEV, CVSS 9+KEV
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
- Mikrotik RouterOS
- Command injection
- CVSS 8.7 High
Unauthenticated file read in Mikrotik RouterOS
- Mikrotik RouterOS
- Path traversal
- Memory corruption
- CVSS 6.9 MediumCritical · KEVKEV
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
- Mikrotik RouterOS
- CWE-841
- CVSS 6.3 Medium
TLS server impersonation possible in Mikrotik RouterOS
- Mikrotik RouterOS
- Weak cryptography or TLS
- CVSS 8.8 HighCritical · KEVKEV
Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
- Mikrotik RouterOS
- Authentication bypass
- CVSS 9.2 CriticalCritical · CVSS 9+
SSH user impersonation possible in Mikrotik RouterOS
- Mikrotik RouterOS
- Weak cryptography or TLS
- CVSS 6.9 Medium
Insufficient session expiration in MikroTik RouterOS
- MikroTik RouterOS
- Authentication bypass
- CVSS 8.7 High
Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router
- MikroTik RouterOS
- MikroTik Cloud Hosted Router
- Authentication bypass
- CVSS 6.5 Medium
Improper certificate validation in multiple RouterOS services
- Mikrotik RouterOS
- Weak cryptography or TLS
- CVSS 6.9 Medium
MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds
- MikroTik RouterOS
- Memory corruption
- CVSS 8.7 High
MikroTik RouterOS libjson.so print parse_json_element buffer overflow
- MikroTik RouterOS
- Memory corruption
- CVSS 4.8 Medium
Cross-site scripting via dst parameter in RouterOS WiFi hotspot
- MikroTik RouterOS
- CWE-20
- CVSS 7.2 High
Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability
- Mikrotik RouterOS
- Broken access control
- CVSS 7.5 High
Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability
- Mikrotik RouterOS
- Memory corruption
- CVSS 7.5 High
MikroTik RouterOS Web Interface Heap Corruption
- MikroTik RouterOS
- Memory corruption
- CVSS 9.1 CriticalCritical · CVSS 9+
MikroTik RouterOS Administrator Privilege Escalation
- MikroTik RouterOS
- Privilege escalation
-
Download of code without integrity check in MikroTik RouterOS
- MikroTik RouterOS
- CWE-494
-
RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack.
- MikroTik RouterOS
-
Missing authentication in MikroTik RouterOS
- MikroTik RouterOS
- Authentication bypass
-
Path traversal in MikroTik RouterOS
- MikroTik RouterOS
- Path traversal
-
Path traversal in MikroTik RouterOS
- MikroTik RouterOS
- Path traversal