CVE-2026-67277 Overview
MikroTik RouterOS contains a missing authentication flaw [CWE-306] in its bandwidth test (btest) service. The service accepts a "related" btest connection before the corresponding primary session completes authentication. An unauthenticated remote client can start an IPv4 UDP test through this state. With random-data=false, the sender transmits uninitialized memory from a kernel packet buffer. A separate unchecked, inverted packet-size interval triggers an unsigned integer underflow that produces anomalously large fragmented output and can restart the RouterOS kernel. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
Unauthenticated attackers can leak kernel memory contents and force a kernel restart on affected MikroTik RouterOS devices over the network.
Affected Products
- MikroTik RouterOS versions prior to 6.49.21 (Long-term)
- MikroTik RouterOS 7.x versions prior to 7.23.4 (Long-term)
- MikroTik RouterOS 7.x versions prior to 7.24.2 (Stable)
Discovery Timeline
- 2026-09-05 - CVE-2026-67277 published to the National Vulnerability Database
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-67277
Vulnerability Analysis
The RouterOS bandwidth test service establishes a primary control session and one or more "related" data connections. The service treats a related connection as trusted once it observes a matching primary session, but does not verify that authentication on the primary session has completed. An unauthenticated client can send a related UDP btest connection and begin transmitting immediately.
When the sender is configured with random-data=false, RouterOS reuses kernel packet buffers without zeroing the tail. Data beyond the intended payload is emitted onto the wire, exposing residual kernel memory contents to a remote observer [CWE-306].
A second defect in the packet-size handling logic accepts an inverted size interval where the minimum exceeds the maximum. The subtraction produces an unsigned integer underflow, and RouterOS then generates oversized fragmented output. The condition can restart the kernel, producing a denial-of-service state on the router.
Root Cause
The bandwidth test service performs connection-tracking-style association without an authentication gate. Related-flow acceptance is decoupled from the completion of the primary session handshake, violating the intent that only authenticated peers can initiate data transfers.
Attack Vector
Exploitation is network-based and requires no privileges or user interaction. An attacker sends crafted btest traffic to a reachable RouterOS device with the bandwidth test service exposed. The attacker can either harvest uninitialized kernel buffer contents by repeatedly triggering non-random data mode, or supply an inverted packet-size range to trigger the underflow and kernel restart. Public reporting from CERT.pl indicates active exploitation in the wild. See the CERT.pl vulnerabilities report and the NPRatley reversing analysis for technical details.
Detection Methods for CVE-2026-67277
Indicators of Compromise
- Unexpected inbound UDP traffic to the RouterOS bandwidth test service (typically TCP/UDP 2000) from untrusted networks.
- RouterOS device reboots or kernel restart log entries without a corresponding administrative action.
- Outbound btest data flows that were not initiated by an authenticated administrator.
- Sudden spikes in fragmented UDP traffic sourced from a RouterOS device.
Detection Strategies
- Inspect RouterOS logs for btest session establishment events that lack a preceding successful authentication event.
- Alert on any inbound connection to the btest service port from outside the management network.
- Correlate device availability monitoring with unexplained kernel restart events on RouterOS platforms.
Monitoring Recommendations
- Forward RouterOS syslog to a centralized SIEM and retain authentication and service-start events.
- Baseline normal bandwidth test usage and alert on deviations, especially connections from non-administrative sources.
- Monitor CISA KEV catalog updates and vendor advisories for follow-on guidance on this CVE.
How to Mitigate CVE-2026-67277
Immediate Actions Required
- Upgrade RouterOS to a fixed version: 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable).
- Disable the bandwidth test service on production routers where it is not required.
- Restrict management-plane services, including btest, to trusted source addresses using firewall input rules.
- Audit device logs and configuration for signs of unauthorized btest sessions.
Patch Information
MikroTik addressed the flaw in RouterOS 6.49.21, 7.23.4, and 7.24.2. Refer to the MikroTik September 2026 security update and the release announcements for 6.49.21, 7.23.4, and 7.24.2.
Workarounds
- Disable the bandwidth test server under /tool bandwidth-server when patching cannot be performed immediately.
- Apply firewall rules on the input chain that drop unsolicited traffic to the btest service from untrusted interfaces.
- Place RouterOS management interfaces behind a dedicated management VLAN or VPN.
# Configuration example: disable btest and restrict management access
/tool bandwidth-server set enabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=2000 action=drop comment="Block btest TCP"
/ip firewall filter add chain=input protocol=udp dst-port=2000 action=drop comment="Block btest UDP"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
