6.9
Medium
CVE-2026-7668 A vulnerability was identified in MikroTik RouterOS 6.49.8
Description
A vulnerability was identified in MikroTik RouterOS 6.49.8. This vulnerability affects the function ASN1_STRING_data in the library nova/lib/www/scep.p of the component SCEP Endpoint. The manipulation of the argument transactionID/messageType leads to out-of-bounds read. The attack may be initiated remotely. The exploit is publicly available and might be used. You should upgrade the affected component. The vendor recommends to "use the latest v6.x or 7.x MikroTik RouterOS version, the reported issue should be fixed there."
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RouterOS | 6.49.8 | No fix stated |
Other CVEs of RouterOS
The 26 CVEs of RouterOS →
CVE-2026-89035
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows…
9.1
Critical
CVE-2026-112158
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8
7.1
High
CVE-2026-103903
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote…
8.7
High
CVE-2026-84411
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling…
9.8
Critical