This vulnerability in MikroTik RouterOS 6.49.8 arises from improper handling of input arguments (transactionID/messageType) in the ASN1_STRING_data function within the SCEP Endpoint component (nova/lib/www/scep.p). This leads to an out-of-bounds read condition, which can be triggered remotely without any privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official remediation or patch has been provided by the vendor, and the vendor has not responded to disclosure attempts. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows an attacker to cause an out-of-bounds read in the RouterOS process handling SCEP requests. While the direct impact is limited to information disclosure or potential application instability, the vulnerability is remotely exploitable without authentication. No evidence of exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider mitigating exposure by restricting access to the SCEP Endpoint or affected services until a patch is released. Monitor official MikroTik channels for updates.