In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The attacker must know the scep_server_name value. This affects RouterOS 6.46.8, 6.47.9, and 6.47.10.
References
Link | Resource |
---|---|
https://mikrotik.com/download/archive | Release Notes Vendor Advisory |
https://teamt5.org/en/posts/vulnerability-mikrotik-cve-2021-41987/ | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-03-16T14:44:58
Updated: 2022-03-29T14:26:57
Reserved: 2021-10-04T00:00:00
Link: CVE-2021-41987
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-03-16T15:15:14.547
Modified: 2022-06-30T19:32:50.887
Link: CVE-2021-41987
JSON object: View
Redhat Information
No data.
CWE