MikroTik RouterOS vulnerabilities

Mikrotik RouterOS versions 6.40.5 through 6.49.10 (fixed in 7) allow a remote attacker to cause a device crash via crafted packet data to the SMB service on TCP port 445.

A product with the MikroTik RouterOS API enabled is vulnerable to insufficient session expiration. Active sessions may retain their previous permission set after inactivity timeouts or user-group changes.

MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts.

A vulnerability in MikroTik RouterOS versions 7.21.x before 7.21.4 and 7.22.x before 7.22.2 exists in the unflatten() function of the libumsg.so library. A remote attacker can exploit this flaw to cause a denial of service (DoS).

A misconfiguration in the default settings of MikroTik RouterOS 7 allows incoming IPv6 UDP traceroute packets. The issue is fixed in version v7.14.

A vulnerability in the bridge2 component of MikroTik RouterOS version 6.40.5 allows attackers to cause a Denial of Service (DoS) by sending crafted packets.