CVE-2026-22109 Details
Description
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
A vulnerability exists in the WebUI template database of MikroTik RouterOS, where factory default passwords for all five account types are stored in cleartext. These default passwords are identical across devices and were not changed on the tested unit.
Users are advised to update RouterOS to a version that includes the fix. MikroTik has released patches in RouterOS versions 6.49.21, 7.23.4, 7.24.2, and 7.25 beta 3. After upgrading, check the RouterOS log for signs of compromise and review the router's configuration for any unauthorized changes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://csirt.divd.nl/CVE-2026-22109 | [email protected] | AdvisoryBroken Link |
| https://csirt.divd.nl/DIVD-2026-00012 | [email protected] | BundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1392 | Use of Default Credentials | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |