MI
Vendor
Mikrotik
108
CVEs
5
On KEV
4
New 30D
Products
RO9.8
RouterOS
Mikrotik
101 CVEs5 on KEV4 new
WI5.9
Winbox
Mikrotik
3 CVEs0 on KEV0 new
RF7.5
Router Firmware
Mikrotik
2 CVEs0 on KEV0 new
CH8.8
Cloud Hosted Router
MikroTik
1 CVEs0 on KEV0 new
RO7.5
Routerboard
Mikrotik
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-89035 New | RO RouterOS MikroTik | 7.4 | Oct 21 | MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass |
| CVE-2026-112158 | RO RouterOS MikroTik | 6.5 | Oct 19 | MikroTik RouterOS ipt_SAME.ko same_check integer overflow |
| CVE-2026-103903 | RO RouterOS MikroTik | 8.8 | Oct 12 | MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation |
| CVE-2026-84411 | RO RouterOS MikroTik | 9.8 | Oct 2 | MikroTik RouterOS Integer Underflow |
| CVE-2026-93345 | RO RouterOS MikroTik | 7.5 | Sep 22 | MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI |
| CVE-2026-89028 | RO RouterOS MikroTik | 7.5 | Sep 16 | MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX |
| CVE-2026-56719 | RO RouterOS MikroTik | 6.5 | Sep 16 | MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX |
| CVE-2026-89021 | RO RouterOS MikroTik | 6.9 | Sep 14 | MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction |
| CVE-2026-89020 | RO RouterOS MikroTik | 4.3 | Sep 14 | MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path |
| CVE-2026-86060 In wildKEV | RO RouterOS Mikrotik | 9.8 | Sep 5 | SSH session privilege manipulation via a crafted username in Mikrotik RouterOS |
| CVE-2026-67281 | RO RouterOS Mikrotik | 7.5 | Sep 5 | Unauthenticated file read in Mikrotik RouterOS |
| CVE-2026-67279 In wildKEV | RO RouterOS Mikrotik | 6.5 | Sep 5 | SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS |
| CVE-2026-67278 | RO RouterOS Mikrotik | 9.1 | Sep 5 | TLS server impersonation possible in Mikrotik RouterOS |
| CVE-2026-67277 In wildKEV | RO RouterOS Mikrotik | 8.2 | Sep 5 | Kernel memory disclosure and denial of service in MikroTik RouterOS btest service |
| CVE-2026-67276 | RO RouterOS Mikrotik | 8.1 | Sep 5 | SSH user impersonation possible in Mikrotik RouterOS |
| CVE-2026-14227 | RO RouterOS MikroTik | 4.9 | Jul 30 | Insufficient session expiration in MikroTik RouterOS |
| CVE-2026-16347 | CH Cloud Hosted Router MikroTik | 8.8 | Jul 28 | Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router |
| CVE-2025-42611 | RO RouterOS Mikrotik | 6.5 | May 5 | Improper certificate validation in multiple RouterOS services |
| CVE-2026-7668 | RO RouterOS MikroTik | 7.3 | May 2 | MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds |
| CVE-2025-6443 | RO Routeros Mikrotik | 7.2 | Jun 25 | Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability |
| CVE-2024-54952 | RO Routeros Mikrotik | 7.5 | May 29 | MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability |
| CVE-2024-54772 | RO Routeros Mikrotik | 5.4 | Feb 11 | An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2 |
| CVE-2023-32154 | RO Routeros Mikrotik | 7.5 | May 3 | Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability |
| CVE-2023-41570 | RO Routeros Mikrotik | 5.3 | Nov 14 | MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API |
| CVE-2023-30800 | RO Routeros Mikrotik | 7.5 | Sep 7 | The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue |
| CVE-2023-30799 | RO Routeros Mikrotik | 7.2 | Jul 19 | MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue |
| CVE-2020-20021 | RO Routeros Mikrotik | 7.5 | Jul 12 | An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon |
| CVE-2023-24094 | RO Routeros Mikrotik | 7.5 | Mar 27 | An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets |
| CVE-2022-45315 | RO Routeros Mikrotik | 9.8 | Dec 5 | Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process |
| CVE-2022-45313 | RO Routeros Mikrotik | 8.8 | Dec 5 | Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process |
| CVE-2017-20149 | RO Routeros Mikrotik | 9.8 | Oct 15 | The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red |
| CVE-2022-36522 | RO Routeros Mikrotik | 6.5 | Aug 26 | Mikrotik RouterOs through stable v6.48.3 was discovered to contain an assertion failure in the component /advanced-tools/nova/bin/netwatch |
| CVE-2022-34960 | RO Routeros Mikrotik | 9.8 | Aug 25 | The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device |
| CVE-2021-36614 | RO Routeros Mikrotik | 6.5 | May 11 | Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client process |
| CVE-2021-36613 | RO Routeros Mikrotik | 6.5 | May 11 | Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the ptp process |
| CVE-2021-41987 | RO Routeros Mikrotik | 8.1 | Mar 16 | In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution |
| CVE-2020-22845 | RO Routeros Mikrotik | 7.5 | Feb 28 | A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests |
| CVE-2020-22844 | RO Routeros Mikrotik | 7.5 | Feb 28 | A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests |
| CVE-2020-20262 | RO Routeros Mikrotik | 6.5 | Jul 21 | Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /ram/pckg/security/nova/bin/ipsec process |
| CVE-2020-20221 | RO Routeros Mikrotik | 6.5 | Jul 21 | Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm process |
| CVE-2020-20219 | RO Routeros Mikrotik | 6.5 | Jul 21 | Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/igmp-proxy process |
| CVE-2020-20249 | RO Routeros Mikrotik | 6.5 | Jul 19 | Mikrotik RouterOs before stable 6.47 suffers from a memory corruption vulnerability in the resolver process |
| CVE-2020-20248 | RO Routeros Mikrotik | 6.5 | Jul 19 | Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process |
| CVE-2020-20230 | RO Routeros Mikrotik | 6.5 | Jul 19 | Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process |
| CVE-2020-20231 | RO Routeros Mikrotik | 6.5 | Jul 14 | Mikrotik RouterOs through stable version 6.48.3 suffers from a memory corruption vulnerability in the /nova/bin/detnet process |
| CVE-2020-20252 | RO Routeros Mikrotik | 6.5 | Jul 13 | Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process |
| CVE-2020-20250 | RO Routeros Mikrotik | 6.5 | Jul 13 | Mikrotik RouterOs before stable version 6.47 suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process |
| CVE-2020-20217 | RO Routeros Mikrotik | 6.5 | Jul 8 | Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process |
| CVE-2020-20225 | RO Routeros Mikrotik | 6.5 | Jul 7 | Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process |
| CVE-2020-20216 | RO Routeros Mikrotik | 6.5 | Jul 7 | Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/graphing process |
| CVE-2020-20215 | RO Routeros Mikrotik | 6.5 | Jul 7 | Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/diskd process |
| CVE-2020-20213 | RO Routeros Mikrotik | 6.5 | Jul 7 | Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process |
| CVE-2020-20212 | RO Routeros Mikrotik | 6.5 | Jul 7 | Mikrotik RouterOs 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/console process |
| CVE-2020-20211 | RO Routeros Mikrotik | 6.5 | Jul 7 | Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an assertion failure vulnerability in the /nova/bin/console process |
| CVE-2020-20266 | RO Routeros Mikrotik | 6.5 | May 19 | Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process |
| CVE-2020-20264 | RO Routeros Mikrotik | 6.5 | May 19 | Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process |
| CVE-2020-20246 | RO Routeros Mikrotik | 6.5 | May 18 | Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the mactel process |
| CVE-2020-20245 | RO Routeros Mikrotik | 6.5 | May 18 | Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the log process |
| CVE-2020-20227 | RO Routeros Mikrotik | 6.5 | May 18 | Mikrotik RouterOs stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/diskd process |
| CVE-2020-20220 | RO Routeros Mikrotik | 6.5 | May 18 | Mikrotik RouterOs prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/bfd process |