CVE-2025-42611
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
RouterOS provides various services that rely on correct verification of client and server certificates, including OpenVPN, CAPsMAN, Dot1x (802.1X). The vulnerability lies in shared certificate validation logic that uses the system certificate store shared by all services. This causes confusion of scope, allowing any certificate authority in the system-wide trust store to be trusted in any context, enabling partial or full authentication bypass in CAPsMAN, OpenVPN, Dot1X and potentially others.
Risk Assessment
An attacker can exploit authentication bypass to gain unauthorized access to services, potentially leading to confidentiality and integrity breaches of communications and possibly device takeover.
Recommendation
Update RouterOS to a version that includes the fix. Also review certificate store configuration and restrict trust to necessary certificate authorities.
Other vulnerabilities in RouterOS
See all- CVE-2026-84411Critical
The web management service in affected RouterOS versions contains an integer underflow in HTTP request body handling that is reachable before authentication. An unauthenticated network attacker can exploit a single crafted request to achieve remote code execution as root or cause a denial of service.
- CVE-2026-86060CriticalActively exploited
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).
- CVE-2026-67279MediumActively exploited
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).
- CVE-2026-67277HighActively exploited
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).
- CVE-2026-56719Medium
MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetupAndX frame. The out-of-bounds read occurs in the SessionSetupAndX handler before any credential validation, potentially exposing sensitive memory contents.
- CVE-2026-67281High
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials. This issue affects only the 7.x branch and was fixed in versions 7.23.4 (Long-term) and 7.24.2 (Stable).
- CVE-2026-67276High
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key. This issue affects only the 7.x branch and was fixed in versions 7.23.4 (Long-term) and 7.24.2 (Stable).
Original NVD description (English source)
RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications. This includes OpenVPN, CAPsMAN, Dot1x (802.1X), among others. The vulnerability lies in shared certificate validation logic which uses the system certificate store that is shared and equally trusted by all system services. This causes confusion of scope, allowing any certificate authority present in the system-wide trust store to be trusted in any context (with some exceptions), allowing partial or full authentication bypass in CAPsMAN, OpenVPN, Dot1X and potentially others.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS