A vulnerability in MikroTik RouterOS 6.49.8’s SCEP Endpoint lets an attacker manipulate the transactionID or messageType arguments to the ASN1_STRING_data function in nova/lib/www/scep.p, causing an out‑of‑bounds read. This overread can expose memory beyond the buffer, potentially revealing sensitive configuration or other internal data. The flaw can be triggered remotely, and publicly available exploits exist. The vendor recommends upgrading to the latest v6.x or 7.x release to address the issue.

The affected product is MikroTik RouterOS, specifically version 6.49.8. The advisory does not list other affected releases, so the flaw appears limited to this edition.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is less than 1%, suggesting a very low yet nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The SCEP service is reachable over the network, enabling a remote attacker to supply crafted parameters and trigger the overread. Publicly available exploits raise the likelihood of exploitation even though broader usage data is missing. Consequently, the risk is moderate, and patching should be prioritized, particularly if the SCEP service is exposed to external networks.