Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• mikrotik routerosup to 5.0 inclusive

Other highest-scoring records for the same primary product.

• CVE-2018-14847MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write aKEV
  95Now
• CVE-2018-7445A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages.KEV
  87Now
• CVE-2026-86060SSH session privilege manipulation via a crafted username in Mikrotik RouterOSKEV
  67This week
• CVE-2026-67277Kernel memory disclosure and denial of service in MikroTik RouterOS btest serviceKEV
  65This week
• CVE-2026-67279SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOSKEV
  57Plan
• CVE-2017-20149The Mikrotik RouterOS web server allows memory corruption in releases before Stable 6.38.5 and Long-term 6.37.5, aka Chimay-Red.
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

State-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use(session({ cookie: { httpOnly: true } }));2app.post("/account/address", updateAddress);

1app.use(session({ cookie: { httpOnly: true, sameSite: "lax" } }));2app.post("/account/address", csrfProtection, updateAddress);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.