CVE-2021-41987
HIGHMikroTik RouterOS 6.46.8, 6.47.9, 6.47.10 - Remote Code Execution via SCEP Server Heap Overflow
Title source: llmDescription
In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The attacker must know the scep_server_name value. This affects RouterOS 6.46.8, 6.47.9, and 6.47.10.
References (2)
Core 2
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://mikrotik.com/download/archive
Exploit, Third Party Advisory x_refsource_misc
https://teamt5.org/en/posts/vulnerability-mikrotik-cve-2021-41987/
Scores
CVSS v3
8.1
EPSS
0.1623
EPSS Percentile
96.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-787
Status
published
Products (3)
mikrotik/routeros
6.46.8
mikrotik/routeros
6.47.9
mikrotik/routeros
6.47.10
Published
Mar 16, 2022
Tracked Since
Feb 18, 2026