Known vulnerabilities in MikroTik RouterOS

Vendor: MikroTik
Software CPE: cpe:2.3:h:mikrotik:mikrotik_routeros:*:*:*:*:*:*:*:*
Total vulnerabilities: 51
Public exploits: 6
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting MikroTik RouterOS MikroTik RouterOS is affected by 51 known vulnerabilities: 3 critical, 7 high, 21 medium, 20 low Critical High Medium Low

Vulnerabilities (51)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU147168 - Improper Verification of Cryptographic Signature
CVE-2026-67278
CWE-347 Medium
No
No
6.49.21, 7.23.4, 7.24.2 06.09.2026 SB2026090616
#VU147169 - Improper Enforcement of Behavioral Workflow
CVE-2026-67279
CWE-841 High
No
No
6.49.21, 7.23.4, 7.24.2 06.09.2026 SB2026090616
#VU147170 - Access of Uninitialized Pointer
CVE-2026-67281
CWE-824 Medium
No
No
6.49.21, 7.23.4, 7.24.2 06.09.2026 SB2026090616
#VU147171 - Argument Injection or Modification
CVE-2026-86060
CWE-88 High
No
No
6.49.21, 7.23.4, 7.24.2 06.09.2026 SB2026090616
#VU147166 - Improper Verification of Cryptographic Signature
CVE-2026-67276
CWE-347 Critical
No
Exploited
6.49.21, 7.23.4, 7.24.2 06.09.2026 SB2026090616
#VU147167 - Missing Authentication for Critical Function
CVE-2026-67277
CWE-306 High
No
No
6.49.21, 7.23.4, 7.24.2 06.09.2026 SB2026090616
#VU78701 - Permissions, Privileges, and Access Controls
CVE-2023-30799
CWE-264 Low
No
No
6.48.7, 6.49.8 27.07.2023 SB2023072712
#VU76283 - Out-of-bounds write
CVE-2023-32154
CWE-787 High
No
No
7.9.1 18.05.2023 SB2023051812
#VU67510 - Improper input validation
CVE-2022-2663
CWE-20 Medium
No
No
7.6 20.09.2022 SB2022092042
SB2022092046
SB2022092047
and 74 more
#VU64107 - NULL Pointer Dereference
CVE-2021-36614
CWE-476 Medium
No
No
6.48.2 08.06.2022 SB2022060842
#VU64106 - NULL Pointer Dereference
CVE-2021-36613
CWE-476 Medium
No
No
6.48.2 08.06.2022 SB2022060842
#VU56089 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-23040
CWE-89 Medium
No
No
- 25.08.2021 SB2021082513
#VU52990 - Memory corruption
CVE-2020-20237
CWE-119 Low
No
No
6.48.3 10.05.2021 SB2021051005
#VU52989 - Memory corruption
CVE-2020-20236
CWE-119 Low
No
No
6.48.3 10.05.2021 SB2021051005
#VU52988 - NULL Pointer Dereference
CVE-2020-20222
CWE-476 Low
No
No
6.48.3 10.05.2021 SB2021051005
#VU52987 - Reachable Assertion
CVE-2020-20214
CWE-617 Low
No
No
6.48.3 10.05.2021 SB2021051005
#VU50608 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-22979
CWE-79 Medium
No
No
- 11.02.2021 SB2021021105
#VU49335 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-3014
CWE-79 Low
No
No
6.48.1 04.01.2021 SB2021010716
#VU46736 - Improper Validation of Array Index
CVE-2020-11881
CWE-129 Medium
Available
No
6.47.4 14.09.2020 SB2020091516
#VU27707 - Resource exhaustion
CWE-400 Low
No
No
6.45.7, 6.46.4 12.05.2020 SB2020051213


Showing elements 1 - 20 out of 51