VULNERABILITY INTELLIGENCE

CVE-2018-10066

CVSS score8.1 HIGH
EPSS probability1.01%
CISA KEVNot currently listed
Published2018-04-13
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of intercepting client traffic to act as a malicious OpenVPN server. This may allow the attacker to gain access to the client's internal network (for example, at site-to-site tunnels).

Weakness classification

  • CWE-295: Improper Certificate Validation

Primary references