MikroTik RouterOS Improper Verification of Cryptographic Signature (CVE-2026-67278)

MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...

MikroTik RouterOS Path Traversal (CVE-2026-67281)

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file- serving path dereferences...

mikrotrick-poc

Лабораторный PoC MikroTrick — CVE-2026-67276 обход аутентификации по открытому ключу SSH в RouterOS Только для лабораторного использования. Запускать исключительно против экземпляров RouterOS, которыми вы владеете. Атака на устройства, которыми вы не владеете, является преступлением CFAA, ст. 267...

mikrotrick-poc

MikroTrick lab PoC — CVE-2026-67276 RouterOS SSH public-key auth bypass Lab use only. Run exclusively against RouterOS instances you own. Attacking devices you do not own is a crime CFAA, Polish art. 267, equivalents. Background CERT PL 2026-09-05 disclosed six RouterOS vulnerabilities, actively...

Jozini-network-scanner

Jozini Network Scanner Built on 2026-09-05 at KwaQondile Library, Jozini KZN using Termux on Android What I Built scanner.py - Port scanner with banner grabbing 20 ports + auto report saving cvecheck.py - Maps RouterOS version to known CVEs final.py - HTTP confirmation of target report.txt -...

CVE-2018-14847

CVE-2018-14847 create global proxy based on RouterOS via CVE-2018-14847 How To Use prepare pip3 install paramiko ipcalc optparse hashlib usage for ip file python3 loop.py -f list.txt for single ip python3 loop.py ip Copyright the poc part in this repository that use CVE-2018-14187 to get...

FOISted

| / \ |/ | | | | | | | | | || | | | | | | | || | | || | \ | / / | | | | || || | | || / | | || /|/ \|,| FOISted: a MikroTik remote jailbreak Description FOISted is an exploit for two post-authentication vulnerabilities in MikroTik's RouterOS. It can be used to remotely jailbreak RouterOS...

CVE-2026-mikrotik-poc

MikroTik RouterOS PoC Collection This repository contains proof-of-concept PoC scripts for several MikroTik RouterOS security issues researched and documented in 2026. The materials are intended for authorized security research, laboratory validation, and controlled testing only. This project is...

Python-MikrotikLoginExploit

Mikrotik Login Exploit PoC Proof of Concept of the Mikrotik vulnerability CVE-2018-14847 especially on Winbox, which works by reading passwords directly from RouterOS on the default port 8291. Original by: https://github.com/BigNerd95/ Requirements Python 3+ Installation on Linux apt install...

EUVD-2026-91836

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

CVE-2026-84411

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

CVE-2026-84411 MikroTik RouterOS Integer Underflow

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

CVE-2026-84411 MikroTik RouterOS Integer Underflow

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

CVE-2026-84411

The web management service in MikroTik RouterOS versions prior to 7.24 is vulnerable to an integer underflow in its HTTP request body handling. This flaw is reachable before authentication , allowing an unauthenticated network attacker to achieve arbitrary code execution as root or cause a denial...

poc-wifi-kazhackstan

poc-wifi-kazhacksta...

CVE-2025-6563

MikroTik Hotspot Login Page Reflected XSS Vulnerability Advisory Overview A reflected Cross-Site Scripting XSS vulnerability was discovered in the MikroTik RouterOS Hotspot login page. The vulnerability is triggered via the dst URL parameter, which improperly sanitizes input, allowing malicious...

pocs_slides

Sharing my advisory, poc, slides and scripts to IoT / protocol security. You can find me at: Medium: https://medium.com/@cq674350529 Blog: https://cq674350529.github.io/ Mail: [email protected] Twitter: @cq674350529 Slides OffByOne2025: Patch Diffing, You Are My Sword! A Deep Dive into Two...

routeros

Investigación de Seguridad en RouterOS Este repositorio contiene diversas herramientas y exploits desarrollados durante la investigación de seguridad en RouterOS de MikroTik. Los distintos proyectos se organizan en los siguientes subdirectorios: 8291honeypot : Un honeypot que escucha mensajes de...

WinboxPoC

WinboxExploit Esta es una prueba de concepto de la vulnerabilidad crítica de WinBox CVE-2018-14847 que permite la lectura arbitraria de archivos con contraseñas en texto plano. La vulnerabilidad ya fue corregida hace tiempo, por lo que este proyecto ha finalizado y no recibirá más soporte ni...

CVE-2026-84411: Integer Underflow (Wrap or Wraparound)

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...