MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures in all RSA‑based services, such as TLS/X.509 certificate validation and SSH host‑key authentication. Its trust store contains an e=3 root CA, and when an attacker can intercept or redirect the RouterOS device’s outbound TLS traffic, the attacker can use that root’s public certificate—without the private key—to forge a trusted intermediate certificate. The forged chain lets the attacker issue certificates for arbitrary hostnames, enabling the device to connect to malicious servers that appear legitimate. The same permissive verification also means that RSA‑based SSH authentication can be subverted, allowing the attacker to impersonate the device’s SSH host key.

The affected product is MikroTik RouterOS. The fix was released in firmware 7.23.6 (Long‑term) and 7.24.3 (Stable). Devices running earlier firmware versions are vulnerable. The vulnerability is not limited to a specific model; all RouterOS devices that contain the e=3 root CA in their trust store are susceptible if their firmware has not received these updates.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of <1% suggests a very low but nonzero exploitation likelihood, and it is not listed in CISA KEV. The attack vector is likely over the network: an attacker who can redirect or control outbound TLS traffic from the RouterOS device can provide the forged certificate chain; the device will accept it without the private key of the root CA. In addition, the permissive RSA verification undermines RSA‑based SSH authentication, potentially allowing an attacker to impersonate the device’s SSH host key. Once authenticated, the attacker can intercept or alter traffic, achieving full TLS impersonation or SSH decryption.