CVE-2021-41987: MikroTik RouterOS

High severity, CVSS 8.1. EPSS: 16.2% chance of exploitation in the next 30 days.

In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The attacker must know the scep_server_name value. This affects RouterOS 6.46.8, 6.47.9, and 6.47.10.

Affected products

• MikroTik RouterOS: version 6.46.8 only; version 6.47.9 only; version 6.47.10 only

Published 2022-03-16. Last modified 2026-06-17.