Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-7668: MikroTik RouterOS: Unauthorised Data Access through SCEP Endpoint

CVE-2026-7668 · published 6 months ago

Summary

A security issue in MikroTik RouterOS 6.49.8 allows an attacker to access sensitive data without permission. This could happen remotely, and exploit code is already available. Users should check for updates from MikroTik to protect their systems.

Original advisory text

A vulnerability was identified in MikroTik RouterOS 6.49.8. This vulnerability affects the function ASN1_STRING_data in the library nova/lib/www/scep.p of the component SCEP Endpoint. The manipulation of the argument transactionID/messageType leads to out-of-bounds read. The attack may be initiated remotely. The exploit is publicly available and might be used. You should upgrade the affected component. The vendor recommends to "use the latest v6.x or 7.x MikroTik RouterOS version, the reported issue should be fixed there."

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-119Buffer Overflow

CWE-125Out-of-bounds Read

Timeline

Published2 May 2026

Updated3 Nov 2026

First seen2 May 2026

Sources

CVE-2026-7668 · NVD

Track software like this

Free during beta