CVE-2026-7668: MikroTik RouterOS RCE Vulnerability

CVE-2026-7668 Overview

CVE-2026-7668 is an out-of-bounds read vulnerability in MikroTik RouterOS 6.49.8. The flaw resides in the ASN1_STRING_data function within the nova/lib/www/scep.p library, part of the Simple Certificate Enrollment Protocol (SCEP) endpoint component. Manipulating the transactionID or messageType arguments triggers a memory boundary violation [CWE-119]. Attackers can initiate the attack remotely without authentication or user interaction. Public exploit details are available, and the vendor did not respond to disclosure attempts.

Critical Impact

Remote, unauthenticated attackers can trigger an out-of-bounds read in the SCEP endpoint, potentially exposing memory contents or causing service disruption on affected MikroTik routers.

Affected Products

• MikroTik RouterOS 6.49.8
• SCEP Endpoint component (nova/lib/www/scep.p)
• ASN1_STRING_data function handling SCEP requests

Discovery Timeline

• 2026-05-02 - CVE-2026-7668 published to the National Vulnerability Database
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7668

Vulnerability Analysis

The vulnerability resides in the SCEP endpoint of MikroTik RouterOS 6.49.8. The ASN1_STRING_data function in nova/lib/www/scep.p reads beyond the bounds of an allocated buffer when processing attacker-controlled values in the transactionID and messageType parameters. SCEP is a protocol used for certificate enrollment between network devices and certificate authorities, and the affected endpoint is reachable over the network. An attacker who can reach the SCEP service can submit crafted requests that force the parser to read memory outside the intended buffer. The condition is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Public exploit code referenced through VulDB and a GitHub issue tracker increases the practical risk for exposed devices.

Root Cause

The root cause is improper bounds validation when handling ASN.1-encoded fields in inbound SCEP messages. The ASN1_STRING_data routine returns a pointer to string contents but does not enforce length checks aligned with the actual buffer size for transactionID and messageType fields. Crafted lengths or truncated structures cause subsequent reads to cross buffer boundaries.

Attack Vector

Exploitation occurs over the network against the SCEP endpoint. No authentication, privileges, or user interaction is required. An attacker sends a malformed SCEP request containing manipulated transactionID or messageType ASN.1 fields. The parser dereferences memory outside the intended bounds, potentially leaking memory contents in responses or destabilizing the service handling certificate enrollment.

No verified proof-of-concept code is reproduced here. Technical details are tracked in the GitHub CVE Issue Discussion and the VulDB Vulnerability Detail.

Detection Methods for CVE-2026-7668

Indicators of Compromise

• Inbound HTTP/HTTPS requests to SCEP endpoints (typically /scep or /cgi-bin/pkiclient.exe) containing oversized or truncated ASN.1 transactionID or messageType fields
• Unexpected RouterOS service crashes or restarts of the www process following SCEP traffic
• SCEP responses returning anomalous payload sizes or non-standard error patterns

Detection Strategies

• Inspect web service logs on RouterOS for SCEP requests originating from unauthorized external sources
• Use network intrusion detection signatures that flag malformed SCEP messages with non-conforming ASN.1 length encodings
• Correlate SCEP request volume with www service availability metrics to identify probing or exploitation attempts

Monitoring Recommendations

• Forward RouterOS system and web service logs to a centralized SIEM for SCEP-specific event correlation
• Alert on any access to the SCEP endpoint from networks that do not host legitimate certificate enrollment clients
• Track response anomalies that may indicate memory disclosure, such as unusual byte patterns in SCEP replies

How to Mitigate CVE-2026-7668

Immediate Actions Required

• Restrict access to the RouterOS SCEP endpoint using firewall rules that allow only authorized certificate enrollment clients
• Disable the SCEP service on RouterOS devices that do not require certificate enrollment functionality
• Inventory all RouterOS 6.49.8 deployments and prioritize internet-exposed devices for remediation

Patch Information

The vendor did not respond to early disclosure attempts, and no official patch is referenced in the CVE record. Administrators should monitor MikroTik release notes for fixes addressing the SCEP endpoint and upgrade once a patched version becomes available. Until then, compensating controls remain the primary defense.

Workarounds

• Block inbound traffic to SCEP-related URIs at perimeter firewalls and network edge devices
• Place RouterOS management and SCEP services behind a VPN or management network isolated from untrusted sources
• If SCEP is required, restrict source IP ranges to known certificate authority infrastructure only

# Example RouterOS firewall configuration to restrict SCEP access
/ip firewall filter
add chain=input protocol=tcp dst-port=80,443 src-address-list=scep-allowed action=accept comment="Allow SCEP from trusted sources"
add chain=input protocol=tcp dst-port=80,443 action=drop comment="Drop untrusted SCEP/web traffic"

/ip firewall address-list
add list=scep-allowed address=10.0.0.0/24 comment="Trusted CA network"