CVE-2026-67278: CWE-347 Improper verification of cryptographic signature in Mikrotik RouterOS

CVE-2026-67278 is a cryptographic signature verification vulnerability in MikroTik RouterOS 7.x. The software accepts malformed RSA/PKCS#1 v1.5 signatures, affecting TLS/X.509 certificate validation and SSH host-key authentication. Because the trust store includes an e=3 root CA, an attacker able to control or redirect outbound TLS connections can misuse the root's public certificate (without the private key) to forge trusted intermediate certificates for arbitrary hostnames. This enables TLS server impersonation and undermines RSA-based SSH authentication. The vulnerability affects versions >=7.0.0 <7.23.6 and >=7.24 <7.24.3. Fixes were released in 7.23.6 and 7.24.3, with incomplete fixes in 7.23.4 and 7.24.2.

An attacker who can control or redirect outbound TLS connections from affected MikroTik RouterOS devices can impersonate TLS servers by forging trusted intermediate certificates without needing the private key of the root CA. This compromises the authenticity of TLS connections and also weakens RSA-based SSH host-key authentication, potentially allowing man-in-the-middle attacks and unauthorized access.

Upgrade MikroTik RouterOS to version 7.23.6 (Long-term) or 7.24.3 (Stable) or later, where the vulnerability has been fully fixed. Versions 7.23.4 and 7.24.2 contain incomplete fixes and should not be considered secure. No other mitigations are indicated by the vendor advisory.