CVE-2025-42611: MikroTik: issue has been published regarding how RouterOS services decide which certificate authorities (CAs) to trust
This MikroTik advisory covers CVE-2025-42611.
- CVE-2025-42611
Key facts
- CISA KEV
- Not listed (catalogue checked )
- Versions named
- 7.21
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Related products & platforms
Description
An issue has been published regarding how RouterOS services decide which certificate authorities (CAs) to trust. Several RouterOS services, such as OpenVPN, CAPsMAN and Dot1X (802.1X), use certificates to verify who they are talking to.
In affected versions these services all use the same system-wide certificate store, so any CA certificate that is trusted on the router is trusted by every service. The issue has been assigned CVE-2025-42611 and was reported by SI-CERT.
What this means in practice: if your router has several CA certificates installed, for example one for OpenVPN and another for a CAPsMAN setup, a certificate issued by one CA could be accepted by a service that was only meant to trust the other one. Depending on your setup, this could allow a device or user to authenticate where it should not.
An attacker still needs a certificate issued by one of the CAs already installed on your router, so a router with a single CA, or with no certificate-based services at all, is not at risk. Who is affected: RouterOS versions before 7.21 (including RouterOS 6), on devices that use more than one CA certificate with certificate-verified services.
Current status: RouterOS 7.21 introduced the ability to limit which CA each service trusts.
Text from the source record.
- 7.21
Official advisory · medium-confidence parse· fetched ·verify at source
How to fix CVE-2025-42611
Vendor guidance
- Current status: RouterOS 7.21 introduced the ability to limit which CA each service trusts.
- This addresses the issue, but only if you configure it: after upgrading, review your OpenVPN, CAPsMAN and Dot1X settings and make sure each one is set to trust only the CA that is meant for it, instead of relying on the system-wide store.
End-of-life dates for MikroTik RouterOS
More MikroTik advisories
CVE-2026-98432Nov 3, 2026MikroTik RouterOS: memory handling vulnerability has been identified in the Linux kernelCVE-2026-88464Oct 20, 2026MikroTik RouterOS: stack buffer overflow vulnerability has been identified in the SNMPCVE-2026-84411Oct 6, 2026MikroTik: integer underflow in HTTP request body handling has been identifiedCVE-2026-89020Sep 14, 2026MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-basedCVE-2026-86060Sep 5, 2026SSH session privilege manipulation via a crafted username in Mikrotik RouterOSCVE-2026-67281Sep 5, 2026Unauthenticated file read in Mikrotik RouterOS
Get an email when MikroTik RouterOS publishes the next one.
See MikroTik RouterOS's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future MikroTik CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
