CVE-2025-42611

CVE-2025-42611 describes a vulnerability within RouterOS that affects services relying on client and server certificate verification, such as OpenVPN, CAPsMAN, and Dot1x (802.1X). The issue stems from shared certificate validation logic that utilizes a system-wide certificate store, which is equally trusted by all system services. This design flaw leads to a "confusion of scope," where any certificate authority present in the system's trust store can be accepted in various contexts, potentially enabling partial or full authentication bypass in CAPsMAN, OpenVPN, Dot1X, and other services. The vulnerability is categorized under CWE-295, which signifies improper certificate validation.