CVE-2021-41987: Buffer Overflow
In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The attacker must know the scepservername value. This affects RouterOS 6.46.8, 6.47.9, and 6.47.10.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-41987?
CVE-2021-41987 is a vulnerability in the SCEP Server of RouterOS in certain MikroTik products that allows an attacker to trigger a heap-based buffer overflow and execute remote code.
What is the severity of CVE-2021-41987?
The severity of CVE-2021-41987 is classified as high with a CVSS score of 8.1.
Which products are affected by CVE-2021-41987?
CVE-2021-41987 affects certain versions of MikroTik RouterOS including 6.46.8, 6.47.9, and 6.47.10.
How can an attacker exploit CVE-2021-41987?
To exploit CVE-2021-41987, the attacker must know the scep_server_name value and can then trigger a heap-based buffer overflow to execute remote code.
How can I mitigate CVE-2021-41987?
To mitigate CVE-2021-41987, it is recommended to update RouterOS to versions that have fixed the vulnerability as provided by MikroTik.