CVE-2026-67278
NONE—CVSS v3
—CVSS v2
0.17%
EPSS (exploit probability)
CWE-347CWE
Description
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation.
This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
Affected routers (0)
No routers currently mapped to this CVE in our database.