PT-2026-36997 · Mikrotik · Routeros

Published 2026-05-05 · Updated 2026-05-07 · CVE-2025-42611

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RouterOS (affected versions not specified)

Description Shared certificate validation logic uses a system certificate store that is trusted equally by all system services. This creates a confusion of scope where any certificate authority in the system-wide trust store can be trusted in any context, potentially leading to partial or full authentication bypass in services such as CAPsMAN, OpenVPN, and Dot1x (802.1X).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-42611

Affected Products

Routeros

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-42611 · Security Note
• https://t.me/cveNotify/162155 · Telegram Post
• https://cert.si/en/cve-2025-42611 · Note
• https://t.me/cveNotify/162549 · Telegram Post