Introduction
Remote attackers have a new way to compromise MikroTik RouterOS 7 deployments through the REST API. A buffer overflow in its JSON parsing logic can lead to memory corruption and potentially remote code execution, and public exploits are already circulating. MikroTik is a widely used networking vendor with a large presence in ISP, enterprise, and critical infrastructure networks. RouterOS runs on hundreds of thousands of routers and wireless devices worldwide, so a flaw in it has consequences for the internet at large.
Technical information
CVE-2025-10948 is a buffer overflow in MikroTik RouterOS 7, in the parse_json_element function of the libjson.so shared library. The REST API endpoint /rest/ip/address/print calls this function, and that endpoint is commonly used to retrieve IP address information through JSON-based API calls.
The cause is insufficient bounds checking during JSON parsing. When a remote attacker sends a specially crafted JSON payload to this endpoint, parse_json_element copies user-supplied data into a fixed-size buffer without properly validating the input length. The result is a classic buffer overflow, where data written past the end of the buffer can corrupt adjacent memory structures.
The vulnerability is classified under:
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-120: Buffer Copy without Checking Size of Input
An attacker can trigger the flaw remotely and without authentication if the REST API is exposed to untrusted networks. The exploit sends oversized or specially crafted JSON elements that make the vulnerable function overwrite memory. Depending on the memory layout and system protections, that can potentially lead to arbitrary code execution.
As of publication, no official patch or detection method is available. Exploit code and technical details are already public in the GitHub PoC and technical details repository.
Affected systems and versions
- MikroTik RouterOS 7
- Vulnerable component: libjson.so, specifically the parse_json_element function
- Vulnerable endpoint: /rest/ip/address/print
- Only RouterOS 7 is confirmed affected. Public sources do not mention earlier versions.
- Systems with the REST API enabled and reachable from untrusted networks are at highest risk
Vendor security history
MikroTik has a documented history of buffer overflow and remote code execution vulnerabilities in RouterOS. Examples include:
- CVE-2018-7445: SMB stack buffer overflow that enabled remote code execution
- CVE-2023-30799: Authentication bypass and privilege escalation in RouterOS
MikroTik has responded inconsistently to security disclosures. It did not answer early disclosure attempts for CVE-2025-10948. Earlier vulnerabilities also saw delayed or incomplete patching, and the research community has questioned the vendor's security maturity.
References
- NVD entry for CVE-2025-10948
- Official CVE entry
- GitHub PoC and technical details
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-120: Buffer Copy without Checking Size of Input
Additional references:
