MikroTik RouterOS
Summary
A critical vulnerability in MikroTik RouterOS allows attackers with low-privilege API access to extract the router's WireGuard private key in plaintext. This flaw, tracked as CVE-2026-14227, enables full VPN impersonation and traffic decryption.
IFF Assessment
The vulnerability allows attackers to gain unauthorized access to sensitive information and impersonate legitimate VPN connections, posing a significant threat to data confidentiality and integrity.
Severity
The CVSS score of 4.9 indicates a medium severity. The vulnerability has a low attack complexity and requires low privileges, but the impact on confidentiality and integrity is significant, allowing for full VPN impersonation and decryption of traffic.
Defender Context
Defenders should be aware of this vulnerability in MikroTik RouterOS, particularly if WireGuard is used for VPN connections. Promptly applying vendor-recommended mitigations, such as ensuring users are logged out when permissions are downgraded, is crucial to prevent exploitation.