MikroTik RouterOS
Plan PatchCVSS 9.8ICS-CERT ICSA-26-272-06Sep 29, 2026
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
MikroTik RouterOS versions before 7.23 contain a vulnerability (CWE-191: integer underflow) that allows an unauthenticated attacker to achieve remote code execution or denial of service via a crafted network request.
What this means
What could happen
An attacker with network access to RouterOS could run arbitrary commands on the router or crash it, disrupting all network traffic and remote connectivity for your facility.
Who's at risk
MikroTik RouterOS administrators managing network infrastructure for water treatment plants, electrical substations, or other critical facilities. Any organization using MikroTik routers for OT network connectivity or remote access.
How it could be exploited
An attacker on the network can send a specially crafted request to the router without needing credentials or user interaction. This allows them to execute commands as the router or stop it from running, affecting all systems that depend on it for connectivity.
Prerequisites
- Network access to RouterOS HTTP/API ports
- No credentials required
remotely exploitableno authentication requiredlow complexityhigh CVSS (9.8)
Exploitability
Unlikely to be exploited — EPSS score 0.9%
Public Proof-of-Concept (PoC) on GitHub (3 repositories)
Affected products (1)
ProductAffected VersionsFix Status
RouterOS<7.24Fix available
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate RouterOS to version 7.23 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/0f87e10c-b70d-458b-9920-d4f9c5889b6dGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.