MikroTik RouterOS EUVD-2026-26801

Requires MikroTik RouterOS 6.49.8 with SCEP (Simple Certificate Enrollment Protocol) endpoint enabled and network-accessible. SCEP is typically exposed on HTTP/HTTPS (ports 80/443) for certificate enrollment workflows. Exploitation succeeds against default SCEP configurations without requiring authentication (PR:N in CVSS vector). Attack complexity is low (AC:L) as it involves standard SCEP request manipulation. Limiting factors: SCEP endpoints are often disabled or restricted to internal networks in production environments, and many deployments use RouterOS 7.x rather than legacy 6.x branches. Organizations not using automated certificate enrollment via SCEP are inherently immune regardless of version.

Real-world risk is moderate despite the 7.3 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations, which is concerning for internet-exposed MikroTik routers. However, the CVSS temporal metrics show E:P (Proof-of-concept exploit exists) and RL:W (Workaround available), tempering immediate urgency. The publicly available GitHub exploit (ezio315/cve#4) lowers the skill barrier for opportunistic scanning. Impact is rated uniformly low (C:L/I:L/A:L), suggesting limited data exfiltration, potential for chained exploitation, or denial-of-service rather than full remote code execution. Critical concern: vendor silence on coordinated disclosure indicates no official patch timeline, forcing reliance on workarounds. SCEP endpoints are typically not exposed to the internet in hardened deployments, which naturally limits attack surface. Organizations using SCEP for automated certificate enrollment face higher risk. No EPSS or KEV data available, suggesting exploitation has not yet reached widespread automated campaigns, but the public POC makes this a plausible medium-term threat for exposed MikroTik devices.

An attacker scans for internet-exposed MikroTik RouterOS devices on ports 80/443 and identifies SCEP endpoints via standard path enumeration. Using the publicly available GitHub exploit code, they craft malicious SCEP enrollment requests with oversized or malformed transactionID/messageType ASN.1 fields. The out-of-bounds read triggers memory disclosure, potentially leaking certificate data, session tokens, or adjacent memory contents, which could facilitate credential harvesting or reconnaissance for follow-on attacks. Repeated exploitation may cause service instability or denial-of-service conditions on the SCEP process.