CVE-2021-41987

high · 8.1

In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The attacker must know the scep_server_name value. This affects RouterOS 6.46.8, 6.47.9, and 6.47.10.

8.1

CVSS

16.2%

EPSS (exploit prob.)

97th

EPSS percentile

2022-03-16

Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-787

Affected products

Vendor	Product	Affected versions
mikrotik	routeros	6.46.8
mikrotik	routeros	6.47.9
mikrotik	routeros	6.47.10

Check a specific version with /api/v1/cve/match.

References

https://mikrotik.com/download/archive
https://teamt5.org/en/posts/vulnerability-mikrotik-cve-2021-41987/
https://mikrotik.com/download/archive
https://teamt5.org/en/posts/vulnerability-mikrotik-cve-2021-41987/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-41987