RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Due to the inclusion of an e=3 root CA in its trust store, an attacker who controls or redirects an outbound TLS connection can utilize the root public certificate to forge a trusted intermediate certificate and issue certificates for arbitrary hostnames, allowing for TLS server impersonation.