SZB-3cca0f7608
MikroTik RouterOS stores credentials in plaintext, per Mikrotik Dojo (CVE-2025-56566)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- MikroTik
- Product
- RouterOS
- First seen
Summary
Mikrotik Dojo reports that it verified in its lab that SMTP and PPP service credentials and DHCP leases are stored in plaintext on MikroTik devices. It says the issue persists in RouterOS 7.24.5, the latest stable version it tested, and that the vendor was informed.
If you use MikroTik
Restrict administrative and physical access to routers
Rotate SMTP and PPP credentials stored on devices
Watch for a MikroTik RouterOS fix for CVE-2025-56566
What the sources say 1
· Mastodon: “We have verified that credentials for external services (SMTP, PPP) and DHCP leases are stored in plaintext in the non-volatile memory of MikroTik devices.” Source