EUVD Vulnerability Catalog

EUVD-2026-72026

Severity: MEDIUM Base Score: 6.3 CVSS Version: 4.0

Vulnerability Description

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. The same permissive verification also undermines RSA-based SSH authentication. This issue affects only 7.x branch was fixed in versions: 7.23.6 (Long-term) and 7.24.3 (Stable). Releases 7.23.4 and 7.24.2 included an incomplete fix.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

▪ Attack Vector (AV): Network
▪ Attack Complexity (AC): Low
▪ Attack Requirements (AT): Present
▪ Privileges Required (PR): None
▪ User Interaction (UI): None
▪ Vulnerability Confidentiality Impact (VC): Low
▪ Vulnerability Integrity Impact (VI): Low
▪ Vulnerability Availability Impact (VA): None
▪ Subsequent Confidentiality Impact (SC): None
▪ Subsequent Integrity Impact (SI): None
▪ Subsequent Availability Impact (SA): None

Affected Vendors & Systems

Vendor MikroTik

References & Advisory Links

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

CERT-PL

EPSS Probability

0.16

Known Aliases
CVE-2026-67278 GHSA-cq44-x9vf-fpqg
Published On

2026-09-05

Last Updated

2026-09-17