6.5
Medium
CVE-2025-42611 RouterOS provides various services that rely on correct verification of client and server certificates to secure…
Description
RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications. This includes OpenVPN, CAPsMAN, Dot1x (802.1X), among others. The vulnerability lies in shared certificate validation logic which uses the system certificate store that is shared and equally trusted by all system services. This causes confusion of scope, allowing any certificate authority present in the system-wide trust store to be trusted in any context (with some exceptions), allowing partial or full authentication bypass in CAPsMAN, OpenVPN, Dot1X and potentially others.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RouterOS 7.20 | earliest → 7.20.x | No fix stated |
Other CVEs of RouterOS
The 26 CVEs of RouterOS →
CVE-2026-89035
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows…
9.1
Critical
CVE-2026-112158
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8
7.1
High
CVE-2026-103903
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote…
8.7
High
CVE-2026-84411
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling…
9.8
Critical