Mikrotik Routeros
86 CVEs affecting Mikrotik Routeros. Latest disclosed: 2026-05-05. Critical: 5, High: 29.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-20149 | Critical | 9.8 | 2022-10-15 | The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red. A remote and unauthenticated u… |
CVE-2022-34960 | Critical | 9.8 | 2022-08-25 | The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the hos… |
CVE-2018-7445 | Critical | 9.8 | 2018-03-19 | A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service… |
CVE-2023-30799 | Critical | 9.1 | 2023-07-19 | MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can esc… |
CVE-2018-14847 | Critical | 9.1 | 2018-08-02 | MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due… |
CVE-2025-10948 | High | 8.8 | 2025-09-25 | A vulnerability has been found in MikroTik RouterOS 7. This affects the function parse_json_element of the file /rest/ip/address/print of the component libjson… |
CVE-2022-45313 | High | 8.8 | 2022-12-05 | Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arb… |
CVE-2019-3976 | High | 8.8 | 2019-10-29 | RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name fie… |
CVE-2018-1156 | High | 8.8 | 2018-08-23 | Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically… |
CVE-2021-41987 | High | 8.1 | 2022-03-16 | In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The atta… |
CVE-2021-27221 | High | 8.1 | 2021-03-19 | MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position… |
CVE-2019-3943 | High | 8.1 | 2019-04-10 | MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authenticated, remote d… |
CVE-2018-10066 | High | 8.1 | 2018-04-13 | An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of interc… |
CVE-2024-54952 | High | 7.5 | 2025-05-29 | MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issue by sending speci… |
CVE-2023-32154 | High | 7.5 | 2024-05-03 | Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code… |
CVE-2023-30800 | High | 7.5 | 2023-09-07 | The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server'… |
CVE-2020-20021 | High | 7.5 | 2023-07-12 | An issue discovered in MikroTik Router v6.46.3 and earlier allows attacker to cause denial of service via misconfiguration in the SSH daemon. |
CVE-2023-24094 | High | 7.5 | 2023-03-27 | An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets. |
CVE-2020-22845 | High | 7.5 | 2022-02-28 | A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted FTP requests. |
CVE-2020-22844 | High | 7.5 | 2022-02-28 | A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via crafted SMB requests. |