Out-of-bounds read in SCEP Endpoint

What is the CVE-2026-7668 vulnerability?

CVE-2026-7668 is a vulnerability affecting the ASN1_STRING_data function in the nova/lib/www/scep.p library of the SCEP Endpoint component in RouterOS 6.49.8. Manipulation of the transactionID/messageType argument leads to an out-of-bounds memory read. The attack can be initiated remotely, and exploitation code is publicly available.

Which RouterOS versions are vulnerable?

The only version declared vulnerable is 6.49.8. The specific fixed version has not yet been announced; the vendor recommends using the latest v6.x or 7.x version of RouterOS, where the issue should be resolved.

Is my router at risk?

A router is exposed if it is running RouterOS 6.49.8 and the SCEP Endpoint component is active and reachable from untrusted networks. Since the attack requires no authentication (PR:N) and can be initiated remotely, the attack surface depends on the reachability of the SCEP service from outside the local network.

Is the CVE-2026-7668 vulnerability actively exploited?

As of the date of this article, CVE-2026-7668 is not listed in the CISA KEV catalog, and ENISA does not report it as being exploited. However, exploitation code is publicly available and could be used.

How to protect the router from CVE-2026-7668?

Update RouterOS to the latest available v6.x or 7.x version, as recommended by the vendor. Alternatively, if an immediate update is not possible, consider disabling the SCEP Endpoint component or blocking access to the service from untrusted networks via network configuration.

Which RouterOS commands are needed to mitigate CVE-2026-7668?

Update RouterOS

The only definitive fix is an update. Save the configuration first; the installation will reboot the router.

# 1. salva configurazione e backup
/export file=prima-aggiornamento
/system backup save name=prima-aggiornamento
# 2. scegli il canale (long-term o stable) e controlla la versione disponibile
/system package update set channel=stable
/system package update check-for-updates
# 3. installa: ATTENZIONE, il router si riavvia
/system package update install
# 4. dopo il riavvio, aggiorna anche il firmware (RouterBOOT) e riavvia di nuovo
/system routerboard upgrade

Official sources

• https://github.com/ezio315/cve/issues/4
• https://vuldb.com/submit/798623
• https://vuldb.com/vuln/360804
• https://vuldb.com/vuln/360804/cti