CVE-2026-67277
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Lont-term), 7.23.4 (Lont-term) and 7.24.2 (Stable)
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.87%
- CISA KEV
- Known exploited vulnerability
- CWE
- CWE-306
- Published
- 2026-09-05
- Last modified
- 2026-09-11
Affected products
- Mikrotik RouterOS
- Mikrotik RouterOS
- Mikrotik RouterOS
Weakness type
Related vulnerabilities
- CVE-2026-81735 — UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution
- CVE-2026-65956 — KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF
- CVE-2026-92808 — Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise
- CVE-2026-82695 — Tenda AC18 Telnet telnet missing authentication
- CVE-2026-82694 — Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication
- CVE-2026-82693 — Tenda AC1206 Web UI telnet TendaTelnet missing authentication
- CVE-2026-80462 — Privilege Escalation in Progress Chef Automate
- CVE-2026-75754 — Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in A