CVE-2025-42611 Improper certificate validation in multiple RouterOS services
Attackers can bypass authentication in RouterOS services like OpenVPN and CAPsMAN by exploiting improper certificate validation logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-42611?
CVE-2025-42611 is a medium-severity authentication bypass vulnerability in Mikrotik RouterOS, published on 5 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications. This includes OpenVPN, CAPsMAN, Dot1x (802.1X), among others.
The vulnerability lies in shared certificate validation logic which uses the system certificate store that is shared and equally trusted by all system services. This causes confusion of scope, allowing any certificate authority present in the system-wide trust store to be trusted in any context (with some exceptions), allowing partial or full authentication bypass in CAPsMAN, OpenVPN, Dot1X and potentially others.
Weakness: CWE-295
Which versions are affected by CVE-2025-42611?
How do I fix CVE-2025-42611?
No fix has been published for CVE-2025-42611 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-42611 being exploited?
There is no known exploitation of CVE-2025-42611 in the wild and no public exploit code.
Sources
Also known as GHSA-qqqc-gw7p-pw85.