CVE-2026-89020: MikroTik RouterOS Buffer Overflow Vulnerability

CVE-2026-89020 Overview

CVE-2026-89020 is a stack-based buffer overflow [CWE-121] in MikroTik RouterOS affecting the mtget binary's Trivial File Transfer Protocol (TFTP) Read Request (RRQ) builder function. The vulnerability affects RouterOS versions before 7.23.4 (long-term) and 7.24.2 (stable). Authenticated users with read-only group membership can crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command. The overflow overwrites saved registers at a deterministic offset via an unbounded rep movsb instruction, producing a reliable denial-of-service condition against the fetch worker.

Critical Impact
Authenticated attackers with only read-only privileges can crash the RouterOS mtget worker process by issuing a crafted tftp:// URL through /tool fetch, without needing a reachable TFTP server.

Affected Products

MikroTik RouterOS long-term releases prior to 7.23.4
MikroTik RouterOS stable releases prior to 7.24.2
The mtget binary responsible for /tool fetch operations

Discovery Timeline

2026-09-14 - CVE-2026-89020 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89020

Vulnerability Analysis

The vulnerability resides in the TFTP RRQ builder function inside the mtget binary, which handles URLs passed to /tool fetch. When constructing the RRQ packet, the function copies the URL path into a fixed 528-byte stack buffer without validating the input length. The first write beyond the buffer boundary occurs at 505 bytes of user-supplied input, and paths of 507 bytes or more trigger corruption of adjacent stack data.

Exploitation only requires an authenticated session with read-only group membership. No reachable TFTP server is needed because the crash occurs during outbound packet construction, before any network transmission is validated. The result is a repeatable crash of the mtget worker process, disrupting fetch functionality on the router.

Root Cause

The RRQ builder uses an unbounded rep movsb instruction to copy the URL path into the 528-byte stack buffer. Because the copy length is derived from the caller-supplied path rather than the buffer size, longer inputs overwrite saved registers and control data on the stack at a deterministic offset. This is a classic stack-based buffer overflow pattern classified under [CWE-121].

Attack Vector

An authenticated attacker issues a /tool fetch command with a crafted tftp:// URL whose path component is 507 bytes or longer. The mtget worker begins building the TFTP RRQ packet, invokes the vulnerable copy routine, and overruns the stack buffer. The corrupted saved registers cause the worker process to crash. Because the trigger path does not depend on a live TFTP endpoint, the attack succeeds in isolated network segments and offline lab environments.

See the VulnCheck Advisory: MikroTik RouterOS Buffer Overflow for the detailed technical writeup.

// No verified proof-of-concept code has been published.
// Refer to the VulnCheck advisory linked above for reproduction details.

Detection Methods for CVE-2026-89020

Indicators of Compromise

Unexpected crashes or restarts of the mtget worker process on RouterOS devices
RouterOS log entries recording /tool fetch commands with abnormally long tftp:// URL paths (approaching or exceeding 507 bytes)
Fetch operations initiated by accounts holding only read-only group membership

Detection Strategies

Audit RouterOS command history and API logs for /tool fetch invocations that specify tftp:// URLs with oversized path components.
Correlate mtget process termination events with the user session that issued the preceding fetch command.
Baseline normal fetch usage per administrator account and alert on deviations, especially from low-privilege accounts.

Monitoring Recommendations

Forward RouterOS syslog output to a centralized logging platform and retain command-execution records for review.
Monitor for repeated worker-process crashes as an indicator of exploitation attempts against CVE-2026-89020.
Track authentication events for read-only accounts that subsequently invoke /tool fetch with TFTP URLs.

How to Mitigate CVE-2026-89020

Immediate Actions Required

Upgrade RouterOS long-term installations to version 7.23.4 or later.
Upgrade RouterOS stable installations to version 7.24.2 or later.
Review user and group memberships and remove /tool fetch capabilities from accounts that do not require them.

Patch Information

MikroTik addressed the vulnerability in RouterOS 7.23.4 (long-term) and 7.24.2 (stable). Release details are available in the MikroTik Forum Release Announcement 7.23.4 and the MikroTik Forum Release Announcement 7.24.2. Administrators should stage patches in a test environment, then apply the upgrade to production routers during a maintenance window.

Workarounds

Restrict management-plane access to trusted administrators and networks using RouterOS firewall filters and address lists.
Enforce strong authentication for all RouterOS accounts and disable inactive credentials.
Where feasible, block outbound TFTP (UDP port 69) at perimeter firewalls to reduce misuse of the fetch tool.

bash

# Restrict RouterOS API and Winbox access to a trusted management subnet
/ip firewall filter add chain=input protocol=tcp dst-port=8291,8728,8729 \
    src-address=!192.0.2.0/24 action=drop comment="Limit RouterOS management access"