# CVE-2025-42611: Authentication bypass in multiple MikroTik RouterOS services via improper certificate validation (shared trust store)

> MikroTik RouterOS 7.20.x and earlier use a single system-wide certificate store that every service trusts equally, so a certificate signed by any trusted CA can authenticate in any service context (CAPsMAN, OpenVPN, 802.1X and others). RouterOS 7.21+ adds per-service trust scoping, but fixes are incomplete and require manual trust-store review after upgrade.

- **Published:** 2026-11-04T06:49:10Z
- **Last reviewed:** 2026-11-04T06:49:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5216
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5216.png
- **ID:** TL-2026-5216
- **Severity:** MEDIUM (CVSS 6.5)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 3
- **CVEs:** CVE-2025-42611

## Description

CVE-2025-42611 (CWE-295 Improper Certificate Validation; CWE-923 Improper Restriction of Communication Channel to Intended Endpoints) was reported by SI-CERT and published by CERT.si on 2026-04-10. RouterOS services that rely on verifying client and server certificates share one system certificate store that is trusted equally by all services. This is a scope-confusion flaw: any certificate authority present in the router's store is trusted in every context, regardless of which service the certificate was imported for.

The advisory and NVD describe partial or full authentication bypass in CAPsMAN (server and client authentication), OpenVPN (server and client authentication) and 802.1X/Dot1X (server certificate authentication). MQTT, DoH, email, Netwatch, LoRa and adlist are indirectly affected. NVD scores the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 MEDIUM). Practical exposure is greatest on devices that hold more than one CA certificate and use certificate-verified services. A certificate issued by any CA the router trusts (for example a public CA, or an unrelated internal CA imported for another purpose) could be accepted where only a specific private CA should be.

RouterOS 7.21 and later introduce per-service trust scoping through the `trust-store` parameter of `/certificate import` and the `builtin-trust-store` setting under `/certificate settings`. MikroTik documents the `trust-store` default as `all`, so certificates imported by existing scripts or before the upgrade stay trusted by every service until an administrator restricts them. The advisory describes the fixes as improved but incomplete and says manual intervention is required after upgrading.

No public exploit or proof of concept is documented, and Tenable states no known exploits are available (VPR 2.1). The advisory publishes no IOCs and no actor attribution. The sources do not describe exploitation in the wild. Dates differ across sources: RouterOS 7.21 stable shipped on 2026-01-12 per the MikroTik forum announcement (7.21beta from 2025-10-07), CERT.si and Tenable give 2026-04-10 for disclosure, and the CVE Program/NVD list publication on 2026-05-05 (ID reserved 2025-04-16 by ENISA) with an NVD last modification on 2026-10-07.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1133 External Remote Services
- T1556 Modify Authentication Process
- T1557 Adversary-in-the-Middle
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2025-42611 RouterOS Certificate Import or Trust-Store Scope Change (trust-store=all) (Splunk) - Post-Exploitation** (`TL-2026-5216-SPL-002`)

Splunk detection for RouterOS log events showing a certificate being imported, added, changed or removed, or the trust-store, builtin-trust-store or builtin-trust-anchors settings being modified. The default trust-store=all makes an imported CA trusted by every service (CAPsMAN, ovpn, dot1x), the root of CVE-2025-42611; an attacker with administrative access can import a CA to persist certificate-based access or loosen trust scoping, and unreviewed settings after the 7.21 upgrade leave the exposure open.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1553.004, T1556, T1562.001, T1649
- **Data sources:** routeros_syslog, splunk:index=network sourcetype=mikrotik:routeros
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype=mikrotik:routeros earliest=-24h message=*certificate* (message=*import* OR message=*trust-store* OR message=*builtin-trust-store* OR message=*builtin-trust-anchors* OR message=*added* OR message=*changed* OR message=*removed*) | eval actor=if(match(message, "by [A-Za-z0-9_.-]+"), replace(message, "^.*by ([A-Za-z0-9_.-]+).*$", "\\1"), "unknown") | eval trust_all=if(match(message, "trust-store=all"), 1, 0) | eval builtin_change=if(match(message, "builtin-trust-(store|anchors)"), 1, 0) | stats count sum(trust_all) as trust_all_events sum(builtin_change) as builtin_trust_changes min(_time) as first_seen max(_time) as last_seen values(message) as sample_messages by host, actor | eval risk=case(trust_all_events>0, "high", builtin_trust_changes>0, "medium", true(), "low") | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has 'certificate'
| where SyslogMessage has_any ('import', 'trust-store', 'builtin-trust-store', 'builtin-trust-anchors', 'added', 'changed', 'removed')
| extend Actor = iff(SyslogMessage matches regex 'by [A-Za-z0-9_.-]+', extract(@'by ([A-Za-z0-9_.-]+)', 1, SyslogMessage), 'unknown')
| extend TrustAll = SyslogMessage has 'trust-store=all'
| extend BuiltinChange = SyslogMessage matches regex 'builtin-trust-(store|anchors)'
| summarize Events = count(), TrustAllEvents = countif(TrustAll), BuiltinTrustChanges = countif(BuiltinChange), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Samples = make_set(SyslogMessage, 5) by Computer, Actor
| extend Risk = case(TrustAllEvents > 0, 'high', BuiltinTrustChanges > 0, 'medium', 'low')
| project Computer, Actor, Risk, Events, TrustAllEvents, BuiltinTrustChanges, FirstSeen, LastSeen, Samples
```

### Sigma

```yaml
title: RouterOS Certificate Import or Trust-Store Setting Change - CVE-2025-42611
id: 7a1e4c52-9b3d-4f6a-8c10-2d5e7f903a21
status: experimental
description: Detects MikroTik RouterOS log messages showing certificate import or changes to trust-store, builtin-trust-store or builtin-trust-anchors. The default trust-store=all makes an imported CA trusted by every service, the scope-confusion condition behind CVE-2025-42611.
references:
    - https://www.cert.si/en/cve-2025-42611/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-42611
    - https://help.mikrotik.com/docs/spaces/ROS/pages/2555969/Certificates
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.credential-access
    - attack.t1553.004
    - attack.t1556
    - attack.t1562.001
    - attack.t1649
    - cve.2025.42611
logsource:
    product: mikrotik
    service: syslog
detection:
    certificate_keywords:
        - 'certificate'
    change_keywords:
        - 'import'
        - 'trust-store'
        - 'builtin-trust-store'
        - 'builtin-trust-anchors'
    condition: certificate_keywords and change_keywords
falsepositives:
    - Planned certificate renewals, Let's Encrypt or internal PKI rollouts
    - Router upgrade to 7.21 or later migrating builtin-trust-anchors settings
level: medium
```

**Known false positives:**

- Planned certificate renewals or internal PKI rollouts performed by network administrators
- RouterOS 7.21 upgrade migrating builtin-trust-anchors to builtin-trust-store
- Provisioning scripts that import certificates with the default trust-store=all

**Tuning notes:** Ensure RouterOS logging for the system, info and certificate topics is forwarded to syslog so configuration changes are logged. Exclude change windows and named PKI automation accounts, and escalate any event where trust_all_events is above 0 outside a change ticket. Review the actor field against the expected administrator list.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2025-42611 RouterOS New External Peer on Certificate-Authenticated Service (CAPsMAN/OpenVPN/802.1X) (Sentinel) - Exploitation (locked: unlock with TL Creds)
- CVE-2025-42611 RouterOS Certificate Import or Trust-Store Scope Change (trust-store=all) (Sentinel) - Post-Exploitation (locked: unlock with TL Creds)
- CVE-2025-42611 RouterOS Certificate Failures Then Success, Cross-Service Reuse or Outbound Verification Errors (Sentinel) - C2/Lateral (locked: unlock with TL Creds)
- CVE-2025-42611 RouterOS New External Peer on Certificate-Authenticated Service (CAPsMAN/OpenVPN/802.1X) (Sigma) - Exploitation (locked: unlock with TL Creds)
- CVE-2025-42611 RouterOS Certificate Import or Trust-Store Scope Change (trust-store=all) (Sigma) - Post-Exploitation (locked: unlock with TL Creds)
- CVE-2025-42611 RouterOS Certificate Failures Then Success, Cross-Service Reuse or Outbound Verification Errors (Sigma) - C2/Lateral (locked: unlock with TL Creds)
- CVE-2025-42611 RouterOS New External Peer on Certificate-Authenticated Service (CAPsMAN/OpenVPN/802.1X) (Splunk) - Exploitation (locked: unlock with TL Creds)
- CVE-2025-42611 RouterOS Certificate Failures Then Success, Cross-Service Reuse or Outbound Verification Errors (Splunk) - C2/Lateral (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CVE-2025-42611 - Authentication bypass in multiple RouterOS services caused by improper certificate validation (CERT.si)](https://www.cert.si/en/cve-2025-42611/)
- [NVD - CVE-2025-42611](https://nvd.nist.gov/vuln/detail/CVE-2025-42611)
- [Tenable Nessus plugin 313232 - MikroTik RouterOS <= 7.20 Authentication Bypass via Improper Certificate Validation](https://www.tenable.com/plugins/nessus/313232)
- [MikroTik RouterOS documentation - Certificates (trust-store, builtin-trust-store)](https://help.mikrotik.com/docs/spaces/ROS/pages/2555969/Certificates)
- [MikroTik security advisories](https://mikrotik.com/supportsec/security)
- [CVE.org record CVE-2025-42611 (CVE Program API)](https://cveawg.mitre.org/api/cve/CVE-2025-42611)
- [INCIBE-CERT early warning - CVE-2025-42611](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2025-42611)
- [MikroTik forum - v7.21 stable is released (changelog)](https://forum.mikrotik.com/t/v7-21-stable-is-released/267773/1)
- [MikroTik forum - v7.21beta testing is released](https://forum.mikrotik.com/t/v7-21beta-testing-is-released/265403/1)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5216