MikroTik ipsec xperts

RouterOS 7.23.4 [long-term] released! ChangelogThis is an important security update. Most configurations are not at risk, but upgrading is highly recommended. To give time to update your systems, we are not currently publishing detailed information. *) bgp - fix BGP link-local nexthops unreachable over a VRF and a crash when disabling an unnumbered connection; *) btest - improve stability; *) certificate - fix changing the built-in trust store setting (introduced in 7.22.2); *) console - improve stability; *) dhcp - improve stability of DHCP handling; *) disk - improve stability of the SMB server; *) fetch - improve stability of the TFTP client; *) ipsec - fixed expired SA handling to prevent "no such item" errors during listing; *) ipsec - improve IKE handshake stability; *) leds - improved interface stats activity for devices with Marvell Prestera switch chip; *) lte - removed extra restart after firmware upgrade for EC200A-EU modem; *) lte - fix the RG650E-EU modem not bringing link up after a firmware update; *) ping - add parameter checks for arp ping; *) snmp - properly validate password length when applying configuration; *) ssh - refactor SSH internal processes and improved system stability; *) system - improve handling of invalid SSL/TLS requests; *) system - improve stability; *) tunnel - fixed stability issue caused by a misconfigured routing loop under bridge (introduced in v7.22); *) webfig - improve stability; *) wifi - updated radio regulatory information; *) winbox - fix the "addresses" spelling in read-only fields; *) wireguard - fixed peer Tx/Rx counters; *) wireguard - generate port number when specified as zero; *) wireguard - reinitialize socket on VRF change; *) www - improve stability; DownloadsMain: arm64 mipsbe mmips tile arm powerpc netinstall x86 x86-iso x86-dude x86-dude-client x86-netinstall64 x86-netinstall-cli btest.exe Extra: arm64 mipsbe mmips tile arm powerpc netinstall x86 Others: https://mikrotik.com/download GPT 💬 ENG ESP P

MikroTik: CVE-2026-67281 RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

MikroTik: CVE-2026-67279 RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

MikroTik: CVE-2026-67278 MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted intermediate and issue certificates for arbitrary hostnames, enabling TLS server impersonation. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

MikroTik: CVE-2026-67277 RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)