MikroTik Network equipment company which makes routers, switches, access points, etc.

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any MikroTik product.

RSS Feeds for MikroTik security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in MikroTik products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by MikroTik Sorted by Most Security Vulnerabilities since 2018

MikroTik Routeros79 vulnerabilities

MikroTik Winbox3 vulnerabilities

Known Exploited MikroTik Vulnerabilities

The following MikroTik vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability	In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. CVE-2018-7445 Exploit Probability: 85.9%	September 8, 2022
MikroTik Router OS Directory Traversal Vulnerability	MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface. CVE-2018-14847 Exploit Probability: 92.8%	December 1, 2021

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 0 vulnerabilities in MikroTik. Last year, in 2025 MikroTik had 7 security vulnerabilities published. Right now, MikroTik is on track to have less security vulnerabilities in 2026 than it did last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	7	9.40
2024	1	0.00
2023	6	7.78
2022	11	8.03
2021	34	6.54
2020	5	5.65
2019	9	7.82
2018	7	7.87

It may take a day or so for new MikroTik vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent MikroTik Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-61481	Oct 27, 2025	RouterOS 7.14.2 RCE via HTTP-Only WebFig An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrators browser and intercept credentials.	Routeros
CVE-2025-10948	Sep 25, 2025	RouterOS 7 BOF via parse_json_element in libjson.so A vulnerability has been found in MikroTik RouterOS 7. This affects the function parse_json_element of the file /rest/ip/address/print of the component libjson.so. The manipulation leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.20.1 and 7.21beta2 mitigates this issue. You should upgrade the affected component. The vendor replied: "Our bug tracker reports that your issue has been fixed. This means that we plan to release a RouterOS update with this fix. Make sure to upgrade to the next release when it comes out."	Routeros
CVE-2025-6563	Jul 03, 2025	MikroTik RouterOS XSS via hotspot dst <7.19.2 A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.	Routeros
CVE-2023-47310	Jun 30, 2025	RouterOS 7 before v7.14 allows IPv6 UDP traceroute A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP traceroute packets.	Routeros
CVE-2025-6443	Jun 25, 2025	RouterOS VXLAN Source IP Improper Access Control Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of remote IP addresses when processing VXLAN traffic. The issue results from the lack of validation of the remote IP address against configured values prior to allowing ingress traffic into the internal network. An attacker can leverage this vulnerability to gain access to internal network resources. Was ZDI-CAN-26415.	Routeros
CVE-2024-54952	May 29, 2025	MikroTik RouterOS 6.40.5 SMB memory corruption DoS MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issue by sending specially crafted packets, triggering a null pointer dereference. This leads to a Remote Denial of Service (DoS), rendering the SMB service unavailable.	Routeros
CVE-2024-54772	Feb 11, 2025	MikroTik RouterOS Winbox Account Enumeration v6.43v7.17.2 Fixed in 6.49.18 An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with an invalid username allows attackers to enumerate for valid accounts.	Routeros
CVE-2023-32154	May 03, 2024	RouterOS RADVD OOB Write Allows RCE (CVE-2023-32154) Mikrotik RouterOS RADVD Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Router Advertisement Daemon. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-19797.	Routeros
CVE-2023-41570	Nov 14, 2023	MikroTik RouterOS 7.1-7.11 Rest API Access Control Flaw MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.	Routeros
CVE-2023-30800	Sep 07, 2023	Heap Memory Corruption in MikroTik RouterOS 6 Web Server (Fixed in 6.49.10) The web server used by MikroTik RouterOS version 6 is affected by a heap memory corruption issue. A remote and unauthenticated attacker can corrupt the server's heap memory by sending a crafted HTTP request. As a result, the web interface crashes and is immediately restarted. The issue was fixed in RouterOS 6.49.10 stable. RouterOS version 7 is not affected.	Routeros