Threat video1:00
CVE-2025-42611 RouterOS Cert Bypass: Detection & IOCs
A certificate from any trusted CA bypasses auth on RouterOS 7.20 and earlier; hunt it with 9 detection rules, 3 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2025-42611 RouterOS Cert Bypass: Detection & IOCs →
Chapters
- 0:00The hookOne trusted certificate authority bypasses every service.
- 0:04The storyRouterOS uses one certificate store.
- 0:10Attack pathReportedly, any trusted certificate bypasses authentication.
- 0:29AttributionNo threat actor: this was defensive research.
- 0:33Indicators of compromiseNo malicious indicators were published.
- 0:39MITRE ATT&CK techniques5 ATT&CK techniques, from initial access to credential access.
- 0:43Remediation3 steps now: Upgrade RouterOS to 7.21 or later.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00One trusted certificate authority bypasses every service.
0:05RouterOS uses one certificate store.
0:08Every service trusts it equally.
0:10Reportedly, any trusted certificate bypasses authentication.
0:14Attackers join CAPsMAN or connect to OpenVPN.
0:19Upgrade to 7.21 and review certificate trust settings.
0:23Manual trust-scope configuration is still required.
0:29No threat actor: this was defensive research.
0:34No malicious indicators were published.
0:395 ATT&CK techniques, from initial access to credential access.
0:443 steps now: Upgrade RouterOS to 7.21 or later.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.