{
  "document" : {
    "aggregate_severity" : {
      "text" : "kritisch"
    },
    "category" : "csaf_base",
    "csaf_version" : "2.0",
    "distribution" : {
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "de-DE",
    "notes" : [ {
      "category" : "legal_disclaimer",
      "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen."
    }, {
      "category" : "description",
      "text" : "MikroTik RouterOS ist ein auf Linux basierendes Betriebssystem, das für MikroTik RouterBOARD Hardware und PC-Installationen entwickelt wurde und umfangreiche Routing-, Firewall- und Netzwerkverwaltungsfunktionen bietet.",
      "title" : "Produktbeschreibung"
    }, {
      "category" : "summary",
      "text" : "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MikroTik RouterOS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um einen Denial of Service Zustand herbeizuführen und um die Kontrolle über betroffene Geräte zu übernehmen.",
      "title" : "Angriff"
    }, {
      "category" : "general",
      "text" : "- BIOS/Firmware",
      "title" : "Betroffene Betriebssysteme"
    } ],
    "publisher" : {
      "category" : "other",
      "contact_details" : "csaf-provider@cert-bund.de",
      "name" : "Bundesamt für Sicherheit in der Informationstechnik",
      "namespace" : "https://www.bsi.bund.de"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "WID-SEC-W-2026-3193 - CSAF Version",
      "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3193.json"
    }, {
      "category" : "self",
      "summary" : "WID-SEC-2026-3193 - Portal Version",
      "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3193"
    }, {
      "category" : "external",
      "summary" : "MikroTik RouterOS September 2026 Vulnerability vom 2026-09-06",
      "url" : "https://mikrotik.com/supportsec/september-2026-vulnerability/"
    }, {
      "category" : "external",
      "summary" : "GitHub Security Advisory GHSA-pqp3-gjgf-83cf vom 2026-09-06",
      "url" : "https://github.com/advisories/GHSA-pqp3-gjgf-83cf"
    }, {
      "category" : "external",
      "summary" : "GitHub Security Advisory GHSA-6425-cjxv-52gp vom 2026-09-06",
      "url" : "https://github.com/advisories/GHSA-6425-cjxv-52gp"
    }, {
      "category" : "external",
      "summary" : "CERT Polska Advisory vom 2026-09-05",
      "url" : "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/"
    } ],
    "source_lang" : "en-US",
    "title" : "MikroTik RouterOS: Mehrere Schwachstellen",
    "tracking" : {
      "current_release_date" : "2026-09-10T22:00:00.000+00:00",
      "generator" : {
        "date" : "2026-09-11T11:26:34.657+00:00",
        "engine" : {
          "name" : "BSI-WID",
          "version" : "1.6.0"
        }
      },
      "id" : "WID-SEC-W-2026-3193",
      "initial_release_date" : "2026-09-06T22:00:00.000+00:00",
      "revision_history" : [ {
        "date" : "2026-09-06T22:00:00.000+00:00",
        "number" : "1",
        "summary" : "Initiale Fassung"
      }, {
        "date" : "2026-09-10T22:00:00.000+00:00",
        "number" : "2",
        "summary" : "Vulname added"
      } ],
      "status" : "final",
      "version" : "2"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_version_range",
          "name" : "<6.49.21",
          "product" : {
            "name" : "MikroTik RouterOS <6.49.21",
            "product_id" : "T059064"
          }
        }, {
          "category" : "product_version",
          "name" : "6.49.21",
          "product" : {
            "name" : "MikroTik RouterOS 6.49.21",
            "product_id" : "T059064-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/o:mikrotik:routeros:6.49.21"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "<7.23.4",
          "product" : {
            "name" : "MikroTik RouterOS <7.23.4",
            "product_id" : "T059065"
          }
        }, {
          "category" : "product_version",
          "name" : "7.23.4",
          "product" : {
            "name" : "MikroTik RouterOS 7.23.4",
            "product_id" : "T059065-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/o:mikrotik:routeros:7.23.4"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "<7.24.2",
          "product" : {
            "name" : "MikroTik RouterOS <7.24.2",
            "product_id" : "T059066"
          }
        }, {
          "category" : "product_version",
          "name" : "7.24.2",
          "product" : {
            "name" : "MikroTik RouterOS 7.24.2",
            "product_id" : "T059066-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/o:mikrotik:routeros:7.24.2"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "<7.25 beta 3",
          "product" : {
            "name" : "MikroTik RouterOS <7.25 beta 3",
            "product_id" : "T059067"
          }
        }, {
          "category" : "product_version",
          "name" : "7.25 beta 3",
          "product" : {
            "name" : "MikroTik RouterOS 7.25 beta 3",
            "product_id" : "T059067-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/o:mikrotik:routeros:7.25_beta_3"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "RouterOS"
      } ],
      "category" : "vendor",
      "name" : "MikroTik"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2026-67276",
    "product_status" : {
      "known_affected" : [ "T059065", "T059064", "T059067", "T059066" ]
    },
    "release_date" : "2026-09-06T22:00:00.000+00:00",
    "title" : "CVE-2026-67276"
  }, {
    "cve" : "CVE-2026-67277",
    "product_status" : {
      "known_affected" : [ "T059065", "T059064", "T059067", "T059066" ]
    },
    "release_date" : "2026-09-06T22:00:00.000+00:00",
    "title" : "CVE-2026-67277"
  }, {
    "cve" : "CVE-2026-67278",
    "product_status" : {
      "known_affected" : [ "T059065", "T059064", "T059067", "T059066" ]
    },
    "release_date" : "2026-09-06T22:00:00.000+00:00",
    "title" : "CVE-2026-67278"
  }, {
    "cve" : "CVE-2026-67279",
    "product_status" : {
      "known_affected" : [ "T059065", "T059064", "T059067", "T059066" ]
    },
    "release_date" : "2026-09-06T22:00:00.000+00:00",
    "title" : "CVE-2026-67279"
  }, {
    "cve" : "CVE-2026-67281",
    "product_status" : {
      "known_affected" : [ "T059065", "T059064", "T059067", "T059066" ]
    },
    "release_date" : "2026-09-06T22:00:00.000+00:00",
    "title" : "CVE-2026-67281"
  }, {
    "cve" : "CVE-2026-86060",
    "product_status" : {
      "known_affected" : [ "T059065", "T059064", "T059067", "T059066" ]
    },
    "release_date" : "2026-09-06T22:00:00.000+00:00",
    "title" : "CVE-2026-86060"
  } ]
}