The flaw resides in RouterOS’s shared certificate validation logic, which consults the system‑wide trust store. Any certificate authority present in that store is accepted by all services that rely on it, including OpenVPN, CAPsMAN, and Dot1X. This creates a trust‑store bypass, allowing an attacker who can introduce a CA to the router to perform authentication bypass and potentially control VPN tunnels or wireless management, thereby compromising confidentiality, integrity, and availability of network communications. The vulnerability is identified as CWE-295.

The affected product is Mikrotik RouterOS. All services that depend on certificate validation—such as OpenVPN, CAPsMAN, and Dot1X—are vulnerable whenever a trusted CA is present in the system certificate store. The advisory does not specify affected firmware versions, implying the issue exists in all current releases that use the shared validation logic.

The CVSS score of 6.5 indicates a medium‑severity flaw. EPSS information is unavailable, and the vulnerability is not listed in CISA KEV. The primary risk is that an attacker who can add a CA to the system trust store can bypass authentication checks in multiple critical services. While the specific attack vector (e.g., local configuration access or remote certificate upload) is not detailed in the advisory, the presence of the flaw suggests that controlling the trust store would enable successful exploitation. The impact is significant because it undermines the primary authentication mechanisms for several core RouterOS services.