MikroTik RouterOS
Summary
A critical vulnerability in MikroTik RouterOS allows attackers with low-privilege API access to extract the router's WireGuard private key in plaintext. This flaw, tracked as CVE-2026-14227, enables full VPN impersonation and traffic decryption.
IFF Assessment
FOE
The vulnerability allows attackers to gain unauthorized access to sensitive information and impersonate legitimate VPN connections, posing a significant threat to data confidentiality and integrity.
Severity
4.9
Medium
Defender Context
Defenders should be aware of this vulnerability in MikroTik RouterOS, particularly if WireGuard is used for VPN connections. Promptly applying vendor-recommended mitigations, such as ensuring users are logged out when permissions are downgraded, is crucial to prevent exploitation.