CVE-2025-42611 — RouterOS provides various services that rely on correct

title: RouterOS CAPsMAN Authentication Bypass via Weak Certificate Validation — CVE-2025-42611
id: scw-2026-05-05-ai-1
status: experimental
level: critical
description: |
  This rule detects potential authentication bypass attempts targeting RouterOS CAPsMAN service by exploiting CVE-2025-42611. The vulnerability allows attackers to leverage improperly validated certificates from the system store to gain unauthorized access. This detection looks for successful login events to the CAPsMAN service on the default port, originating from any IP, with a specific URI query pattern indicative of certificate verification attempts.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2025-42611/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: authentication
detection:
  selection:
      src_ip:
          - '0.0.0.0/0'
      dst_port:
          - '8291'
      dst_ip:
          - '192.168.88.1'
      action:
          - 'login_success'
      User:
          - 'admin'
  selection_indicators:
      cs-uri-query|contains:
          - '/certificate/verify'
      cs-uri|contains:
          - '/capsman'
  condition: selection AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse