An out-of-bounds read vulnerability in MikroTik RouterOS Scep Server allows unauthenticated remote attackers to trigger information disclosure through crafted PKIOperation requests.

This is an out-of-bounds read vulnerability (CWE-125) residing in the nova/lib/www/scep.p component, triggered by passing non-NUL-terminated ASN.1 PrintableString attributes such as transactionID to the SCEP endpoint without authentication.

A successful exploit allows remote attackers to read sensitive memory contents prior to authentication, potentially exposing internal system data and leading to abnormal parser behavior or denial of service conditions. Although the CVSS score is 7.3, which places it in the high severity range, the ability for unauthenticated remote actors to target edge routing hardware significantly increases operational risk and requires prompt attention.

Immediate Action: Upgrade to the latest supported MikroTik RouterOS v6.x or v7.x version where the SCEP parsing issue has been resolved.

Proactive Monitoring: Monitor firewall and web server access logs for anomalous POST requests directed to the SCEP endpoint using the /scep/?operation=PKIOperation URI.

Compensating Controls: Restrict access to the SCEP endpoint using IP whitelisting or deploy a Web Application Firewall rule to inspect and block malformed PKCS#7 requests.

Public Exploit Available: Yes, a public proof-of-concept exists via the reference writeup at github.com/ezio315/cve/issues/4.

Given the availability of a public proof-of-concept and the remote unauthenticated attack vector against network infrastructure, administrators must treat this high-severity finding with urgency. Apply the vendor security updates immediately to vulnerable RouterOS instances to secure the SCEP interface against potential exploitation.