CVE-2026-7668 | MikroTik RouterOS 6.49.8 SCEP Endpoint nova/lib/www/scep.p ASN1_STRING_data transactionID/messageType out-of-bounds

SecurityVulns
Yanac

A vulnerability identified as critical has been detected in MikroTik RouterOS 6.49.8. This vulnerability affects the function ASN1_STRING_data in the library nova/lib/www/scep.p of the component SCEP Endpoint. The manipulation of the argument transactionID/messageType leads to out-of-bounds read.

This vulnerability is listed as CVE-2026-7668. The attack may be initiated remotely. In addition, an exploit is available.

It is recommended to apply restrictive firewalling.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More