MikroTik RouterOS EUVD-2025-210924

Requires physical possession of the MikroTik device running firmware 7.19.4 and the ability to perform a hardware SPI flash dump (bench access, flash programmer/clip). No authentication, no knowledge of the administrative password, and no user interaction are needed once physical access is obtained. The exploitation is strictly local/physical: it cannot be triggered over the network, remotely, or against a device the attacker cannot physically handle - which is the primary factor limiting real-world risk.

The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6 Medium) tells the real story: this is a physical-access-only confidentiality issue, not a network-exploitable one. The AV:P requirement is the dominant limiting factor - an attacker must physically possess the device and dump its SPI flash, which cannot be done remotely or at scale. This is consistent with the low EPSS score (0.18%, 8th percentile), which correctly predicts negligible probability of widespread exploitation. There is no CISA KEV listing (no confirmed active exploitation) and no public exploit code beyond the RIFTI Offensive Security advisory write-up, so this is 'no public exploit identified at time of analysis.' The CWE-312 (cleartext storage) classification, the description, and the CVSS vector all agree, so there is no conflicting signal here. Net assessment: technically valid but low real-world priority - it matters for high-security or physically-exposed deployments (theft, RMA, decommissioning, lawful-access scenarios), not for typical remote-threat models. Note the CPE string is the junk placeholder 'cpe:2.3:a:n/a:n/a:*' and EUVD affected version is 'n/a n/a', so the affected-version scope beyond the stated firmware 7.19.4 is not machine-resolvable from this data.

An attacker who obtains physical possession of a MikroTik device (e.g. a stolen, RMA-returned, or decommissioned unit, or one in an unsecured wiring closet) attaches an SPI flash programmer and dumps the non-volatile storage. Because credentials and network state are stored in cleartext, the attacker reads administrative secrets and network configuration directly from the dump without ever authenticating or knowing the admin password. No public exploit tool is required beyond a standard flash-reading rig; the RIFTI advisory documents the technique.