CVE-2026-67278: MikroTik RouterOS TLS Certificate Forgery

CVE-2026-67278 Overview

CVE-2026-67278 is a signature validation flaw [CWE-347] in MikroTik RouterOS 7.x that accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 certificate validation. RouterOS ships with a trust store containing a root certificate authority (CA) that uses a public exponent of e=3. An attacker who controls or redirects an outbound RouterOS Transport Layer Security (TLS) connection can leverage the root's public certificate, without possessing its private key, to forge a trusted intermediate CA. That forged intermediate can then issue certificates for arbitrary hostnames, enabling TLS server impersonation against the router.

Critical Impact
Attackers can impersonate any TLS server that RouterOS trusts, allowing interception and manipulation of outbound router communications without triggering certificate validation errors.

Affected Products

MikroTik RouterOS 7.x branch (Long-term) prior to 7.23.4
MikroTik RouterOS 7.x branch (Stable) prior to 7.24.2
Not affected: RouterOS 6.x branch

Discovery Timeline

2026-09-05 - CVE-2026-67278 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-67278

Vulnerability Analysis

The flaw resides in how RouterOS parses and validates RSA signatures encoded with PKCS#1 v1.5 padding during X.509 certificate chain verification. The implementation fails to strictly enforce the structure of the padded signature block after RSA decryption. This weakness is a variant of the Bleichenbacher signature forgery class, first documented against low-exponent RSA keys in 2006. The exposure is amplified because the RouterOS trust store includes a root CA whose public exponent equals 3, making cube-root forgery arithmetically practical.

An attacker positioned to intercept outbound TLS connections initiated by the router can present a forged certificate chain. Because RouterOS accepts the malformed signature as valid, the router treats an attacker-issued certificate for any hostname as trusted. This defeats server authentication for services the router contacts, including update endpoints, cloud management, and other TLS-protected outbound flows.

Root Cause

The root cause is improper verification of a cryptographic signature [CWE-347]. RouterOS does not verify that the PKCS#1 v1.5 padding, ASN.1 DigestInfo structure, and hash value occupy the full RSA modulus width. When paired with an e=3 root CA in the trust store, the parser accepts signatures where trailing bytes after the hash are unchecked, permitting an attacker to construct a value whose cube fits the expected format.

Attack Vector

Exploitation requires network positioning to redirect or intercept a RouterOS-initiated TLS connection. No authentication to the router is needed. The attacker generates a forged intermediate CA certificate signed by exploiting the malformed-signature weakness against the e=3 root, then issues a leaf certificate for the target hostname. The router completes the TLS handshake without warnings, allowing the attacker to read and modify traffic. Full technical analysis is available in the NPratley Analysis of Silent Patch and the CERT PL CVE Advisory.

Detection Methods for CVE-2026-67278

Indicators of Compromise

Unexpected TLS certificates presented to RouterOS devices during outbound connections, especially certificates chaining to the built-in e=3 root CA but not issued by its legitimate operator.
Outbound RouterOS traffic to update, cloud, or telemetry endpoints being redirected to unexpected IP addresses or autonomous systems.
RouterOS devices running vulnerable 7.x versions with no recent firmware upgrade activity.

Detection Strategies

Inventory all RouterOS devices and flag any running 7.x versions below 7.23.4 (Long-term) or 7.24.2 (Stable).
Inspect network flows from RouterOS devices for TLS sessions terminating at unapproved destinations.
Correlate DNS resolution logs for RouterOS-originated queries with expected MikroTik service endpoints to identify redirection attempts.

Monitoring Recommendations

Enable centralized syslog forwarding from RouterOS devices and monitor for certificate errors, TLS renegotiation anomalies, and unexpected outbound connections.
Deploy passive TLS inspection at network egress to record certificate fingerprints presented to RouterOS management traffic.
Alert on any RouterOS device that pulls updates or contacts cloud services from a new or unusual upstream path.

How to Mitigate CVE-2026-67278

Immediate Actions Required

Upgrade RouterOS 7.x Long-term installations to 7.23.4 or later immediately.
Upgrade RouterOS 7.x Stable installations to 7.24.2 or later immediately.
Restrict RouterOS outbound connectivity to a known allowlist of destinations until patching completes.
Review the MikroTik Vulnerability Update for vendor-specific guidance and refer to CERT PL Active Exploits Report for exploitation context.

Patch Information

MikroTik addressed the flaw in the 7.23.4 Long-term release and the 7.24.2 Stable release. The fix corrects PKCS#1 v1.5 signature parsing so that malformed padding is rejected during X.509 validation. Devices on the 6.x branch are not affected and require no action for this CVE.

Workarounds

Block outbound TLS from RouterOS devices to all destinations that are not strictly required for operations.
Route RouterOS management traffic through a TLS-inspecting proxy that enforces strict certificate pinning against MikroTik service endpoints.
Disable automatic update checks and cloud features on RouterOS until firmware is upgraded.

bash

# Verify installed RouterOS version and upgrade channel
/system resource print
/system package update set channel=long-term
/system package update check-for-updates
/system package update download
/system reboot