CVE-2025-42611: Authentication bypass in multiple MikroTik RouterOS services via improper certificate validation (shared trust store)

Key facts for MikroTik RouterOS cert bypass

Detection coverage for MikroTik RouterOS cert bypass

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5216 across Splunk SPL, Microsoft KQL and Sigma, covering 3 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2025-42611 RouterOS Certificate Import or Trust-Store Scope Change (trust-store=all) (Splunk) - Post-Exploitation

Splunk detection for RouterOS log events showing a certificate being imported, added, changed or removed, or the trust-store, builtin-trust-store or builtin-trust-anchors settings being modified. The default trust-store=all makes an imported CA trusted by every service (CAPsMAN, ovpn, dot1x), the root of CVE-2025-42611; an attacker with administrative access can import a CA to persist certificate-based access or loosen trust scoping, and unreviewed settings after the 7.21 upgrade leave the exposure open.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1553.004, T1556, T1562.001, T1649
• Data sources: routeros_syslog, splunk:index=network sourcetype=mikrotik:routeros
• Severity: medium
• Confidence: high

Splunk SPL

index=network sourcetype=mikrotik:routeros earliest=-24h message=*certificate* (message=*import* OR message=*trust-store* OR message=*builtin-trust-store* OR message=*builtin-trust-anchors* OR message=*added* OR message=*changed* OR message=*removed*) | eval actor=if(match(message, "by [A-Za-z0-9_.-]+"), replace(message, "^.*by ([A-Za-z0-9_.-]+).*$", "\\1"), "unknown") | eval trust_all=if(match(message, "trust-store=all"), 1, 0) | eval builtin_change=if(match(message, "builtin-trust-(store|anchors)"), 1, 0) | stats count sum(trust_all) as trust_all_events sum(builtin_change) as builtin_trust_changes min(_time) as first_seen max(_time) as last_seen values(message) as sample_messages by host, actor | eval risk=case(trust_all_events>0, "high", builtin_trust_changes>0, "medium", true(), "low") | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has 'certificate'
| where SyslogMessage has_any ('import', 'trust-store', 'builtin-trust-store', 'builtin-trust-anchors', 'added', 'changed', 'removed')
| extend Actor = iff(SyslogMessage matches regex 'by [A-Za-z0-9_.-]+', extract(@'by ([A-Za-z0-9_.-]+)', 1, SyslogMessage), 'unknown')
| extend TrustAll = SyslogMessage has 'trust-store=all'
| extend BuiltinChange = SyslogMessage matches regex 'builtin-trust-(store|anchors)'
| summarize Events = count(), TrustAllEvents = countif(TrustAll), BuiltinTrustChanges = countif(BuiltinChange), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Samples = make_set(SyslogMessage, 5) by Computer, Actor
| extend Risk = case(TrustAllEvents > 0, 'high', BuiltinTrustChanges > 0, 'medium', 'low')
| project Computer, Actor, Risk, Events, TrustAllEvents, BuiltinTrustChanges, FirstSeen, LastSeen, Samples

Sigma

title: RouterOS Certificate Import or Trust-Store Setting Change - CVE-2025-42611
id: 7a1e4c52-9b3d-4f6a-8c10-2d5e7f903a21
status: experimental
description: Detects MikroTik RouterOS log messages showing certificate import or changes to trust-store, builtin-trust-store or builtin-trust-anchors. The default trust-store=all makes an imported CA trusted by every service, the scope-confusion condition behind CVE-2025-42611.
references:
    - https://www.cert.si/en/cve-2025-42611/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-42611
    - https://help.mikrotik.com/docs/spaces/ROS/pages/2555969/Certificates
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.credential-access
    - attack.t1553.004
    - attack.t1556
    - attack.t1562.001
    - attack.t1649
    - cve.2025.42611
logsource:
    product: mikrotik
    service: syslog
detection:
    certificate_keywords:
        - 'certificate'
    change_keywords:
        - 'import'
        - 'trust-store'
        - 'builtin-trust-store'
        - 'builtin-trust-anchors'
    condition: certificate_keywords and change_keywords
falsepositives:
    - Planned certificate renewals, Let's Encrypt or internal PKI rollouts
    - Router upgrade to 7.21 or later migrating builtin-trust-anchors settings
level: medium

Known false positives:

• Planned certificate renewals or internal PKI rollouts performed by network administrators
• RouterOS 7.21 upgrade migrating builtin-trust-anchors to builtin-trust-store
• Provisioning scripts that import certificates with the default trust-store=all

Tuning notes: Ensure RouterOS logging for the system, info and certificate topics is forwarded to syslog so configuration changes are logged. Exclude change windows and named PKI automation accounts, and escalate any event where trust_all_events is above 0 outside a change ticket. Review the actor field against the expected administrator list.

• 🔒 CVE-2025-42611 RouterOS New External Peer on Certificate-Authenticated Service (CAPsMAN/OpenVPN/802.1X) (Sentinel) - Exploitation · unlock with TL Creds
• 🔒 CVE-2025-42611 RouterOS Certificate Import or Trust-Store Scope Change (trust-store=all) (Sentinel) - Post-Exploitation · unlock with TL Creds
• 🔒 CVE-2025-42611 RouterOS Certificate Failures Then Success, Cross-Service Reuse or Outbound Verification Errors (Sentinel) - C2/Lateral · unlock with TL Creds
• 🔒 CVE-2025-42611 RouterOS New External Peer on Certificate-Authenticated Service (CAPsMAN/OpenVPN/802.1X) (Sigma) - Exploitation · unlock with TL Creds
• 🔒 CVE-2025-42611 RouterOS Certificate Import or Trust-Store Scope Change (trust-store=all) (Sigma) - Post-Exploitation · unlock with TL Creds
• 🔒 CVE-2025-42611 RouterOS Certificate Failures Then Success, Cross-Service Reuse or Outbound Verification Errors (Sigma) - C2/Lateral · unlock with TL Creds
• 🔒 CVE-2025-42611 RouterOS New External Peer on Certificate-Authenticated Service (CAPsMAN/OpenVPN/802.1X) (Splunk) - Exploitation · unlock with TL Creds
• 🔒 CVE-2025-42611 RouterOS Certificate Failures Then Success, Cross-Service Reuse or Outbound Verification Errors (Splunk) - C2/Lateral · unlock with TL Creds

Indicators of compromise for MikroTik RouterOS cert bypass

As of 2026-11-04, Threadlinqs Intelligence tracks 3 indicators of compromise for TL-2026-5216.

How MikroTik RouterOS cert bypass works

CVE-2025-42611 (CWE-295 Improper Certificate Validation; CWE-923 Improper Restriction of Communication Channel to Intended Endpoints) was reported by SI-CERT and published by CERT.si on 2026-04-10. RouterOS services that rely on verifying client and server certificates share one system certificate store that is trusted equally by all services. This is a scope-confusion flaw: any certificate authority present in the router's store is trusted in every context, regardless of which service the certificate was imported for.

The advisory and NVD describe partial or full authentication bypass in CAPsMAN (server and client authentication), OpenVPN (server and client authentication) and 802.1X/Dot1X (server certificate authentication). MQTT, DoH, email, Netwatch, LoRa and adlist are indirectly affected. NVD scores the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 MEDIUM). Practical exposure is greatest on devices that hold more than one CA certificate and use certificate-verified services. A certificate issued by any CA the router trusts (for example a public CA, or an unrelated internal CA imported for another purpose) could be accepted where only a specific private CA should be.

RouterOS 7.21 and later introduce per-service trust scoping through the `trust-store` parameter of `/certificate import` and the `builtin-trust-store` setting under `/certificate settings`. MikroTik documents the `trust-store` default as `all`, so certificates imported by existing scripts or before the upgrade stay trusted by every service until an administrator restricts them. The advisory describes the fixes as improved but incomplete and says manual intervention is required after upgrading.

No public exploit or proof of concept is documented, and Tenable states no known exploits are available (VPR 2.1). The advisory publishes no IOCs and no actor attribution. The sources do not describe exploitation in the wild. Dates differ across sources: RouterOS 7.21 stable shipped on 2026-01-12 per the MikroTik forum announcement (7.21beta from 2025-10-07), CERT.si and Tenable give 2026-04-10 for disclosure, and the CVE Program/NVD list publication on 2026-05-05 (ID reserved 2025-04-16 by ENISA) with an NVD last modification on 2026-10-07.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1078 Valid Accounts

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1133 External Remote Services

defense-impairment

T1556 Modify Authentication Process

Credential Access

T1557 Adversary-in-the-Middle

Remediation for MikroTik RouterOS cert bypass

Patches

• RouterOS 7.21 and later (improved but incomplete; manual trust-store configuration still required)

Immediate actions

• Upgrade RouterOS to 7.21 or later
• Inventory all certificates imported on RouterOS devices and identify those with trust-store=all
• Restrict the trust-store value of every imported certificate to only the services that need it (e.g. capsman, ovpn, dot1x)

Workarounds

• Manually restrict trust-store for all imported certificates
• Remove unneeded CA certificates from the router
• Add a second authentication factor (e.g. credentials) to OpenVPN and other certificate-authenticated services

Longer-term hardening

• Review certificate import scripts, since the default trust-store parameter is all
• Review /certificate settings builtin-trust-store and limit built-in CAs to required services
• Segment sensitive services such as CAPsMAN, OpenVPN and 802.1X from untrusted networks
• Do not rely on certificates as the sole authentication factor

Affected and fixed versions

• MikroTik — RouterOS
  Vulnerable versions: 7.20.x and earlier (0 through 7.20.x per NVD); RouterOS 6 (per aggregator reports)
  Fixed in: 7.21 and later (partial; manual trust-store restriction required)

Timeline of MikroTik RouterOS cert bypass

• 2025-04-16 CVE-2025-42611 ID reserved by ENISA (CVE Program record dateReserved).
• 2025-10-07 locked-ioc-2 releases RouterOS 7.21beta, the testing branch that introduces the certificate trust-store parameter and configurable built-in trust store (the latter noted in 7.21beta9).
• 2025-11-26 RouterOS 7.21beta11 released, the latest 7.21 beta listed on the locked-ioc-2 forum thread, carrying the trust-store changes.
• 2026-01-12 RouterOS 7.21 stable released per the locked-ioc-2 forum announcement: adds the certificate 'trust-store' parameter and a built-in trust store option replacing 'builtin-trust-anchors'. Existing imported certificates default to trust-store=all, so manual restriction is still required.
• 2026-04-10 CERT.si publishes the advisory for CVE-2025-42611 (reported by locked-ioc-3), stating fixes in 7.21 are improved but incomplete; Tenable also records disclosure on this date.
• 2026-05-05 CVE-2025-42611 published in NVD / the CVE Program with CVSS:3.1 6.5 (MEDIUM), CWE-295, affected 0 through 7.20.x.
• 2026-05-08 Tenable publishes Nessus plugin 313232 to detect RouterOS <= 7.20; VPR 2.1 and no known exploits.
• 2026-10-07 NVD record last modified.

Sources cited for MikroTik RouterOS cert bypass

• CVE-2025-42611 - Authentication bypass in multiple RouterOS services caused by improper certificate validation (CERT.si) cert.si · Advisory · 2026-04-10
• NVD - CVE-2025-42611 NVD (NIST) · Advisory · 2026-05-05
• CVE.org record CVE-2025-42611 (CVE Program API) MITRE · Advisory · 2026-05-05
• INCIBE-CERT early warning - CVE-2025-42611 incibe.es · Advisory
• Tenable Nessus plugin 313232 - MikroTik RouterOS <= 7.20 Authentication Bypass via Improper Certificate Validation Tenable · Research · 2026-05-08
• MikroTik RouterOS documentation - Certificates (trust-store, builtin-trust-store) help.mikrotik.com · Vendor report
• MikroTik security advisories mikrotik.com · Vendor report
• MikroTik forum - v7.21 stable is released (changelog) forum.mikrotik.com · Vendor report · 2026-01-12
• MikroTik forum - v7.21beta testing is released forum.mikrotik.com · Vendor report · 2025-10-07

More in vulnerability

• Critical Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Lets Attackers Write Server Files via Crafted ImageMagick Uploads
• Google Chrome 157 Security Update Fixes 213 Bugs Including 7 Critical Vulnerabilities (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126)
• rsync CPU Exhaustion via Algorithmic Complexity in hash_search() (CVE-2026-119741) - Fixed in 3.5.2
• CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User Portal
• SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)