Executive brief
A security vulnerability exists in MikroTik RouterOS, the operating system used in MikroTik networking hardware like routers and switches. An attacker can exploit a flaw in the Simple Certificate Enrollment Protocol (SCEP) service to access sensitive information from the device's memory without needing to log in. This could lead to the disclosure of private data or cause the device to behave unpredictably, potentially impacting network security and operations.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the SCEP Endpoint component of MikroTik RouterOS, specifically within the nova/lib/www/scep.p library. The flaw is caused by the improper handling of ASN.1 length information when parsing PKCS#7 signed attributes such as transactionID and messageType. The function ASN1_STRING_data() returns raw pointers that are subsequently treated as NUL-terminated C-strings without verifying the original ASN.1 attribute boundaries. A remote, unauthenticated attacker can trigger this by sending a crafted PKIOperation request containing a non-NUL-terminated ASN.1 PrintableString. This results in the disclosure of memory contents in certRep replies. The vendor recommends upgrading to the latest v6.x or 7.x versions where the issue is addressed.
Affected products
- MikroTik RouterOS 6.49.8
Timeline
- 2026-04-04: disclosed: Initial disclosure on GitHub by researcher
- 2026-05-02: advisory: NVD/VulDB publication date