CVE-2026-89028 Overview
CVE-2026-89028 is a heap memory corruption vulnerability in MikroTik RouterOS versions before 7.24. The flaw resides in the userspace Server Message Block (SMB) daemon and is reachable over the network without authentication. A remote attacker can send a malformed SMB1 SessionSetupAndX request containing a crafted uniPwdLen field. The value triggers an integer underflow that is subsequently used as the length parameter in a memory copy into a smaller heap buffer, corrupting adjacent heap memory. The vulnerability is classified under [CWE-122: Heap-based Buffer Overflow].
Critical Impact
Unauthenticated network attackers can corrupt heap memory in the RouterOS SMB daemon, leading to denial of service on affected router infrastructure.
Affected Products
- MikroTik RouterOS versions prior to 7.24
- MikroTik devices with the SMB service enabled
- Network infrastructure exposing SMB (TCP/445) via RouterOS
Discovery Timeline
- 2026-09-16 - CVE-2026-89028 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89028
Vulnerability Analysis
The vulnerability exists in the SMB1 SessionSetupAndX handler within the RouterOS userspace SMB daemon. During session setup, the handler reads the uniPwdLen field from the client-supplied request. The handler fails to validate this length against expected bounds before using it in arithmetic.
An attacker sends a value that causes an integer underflow when the handler computes an offset or remaining size. The underflowed value wraps to a large unsigned integer. That value is then passed to a memory copy routine as the length parameter. The destination buffer on the heap is significantly smaller than the resulting copy length, so adjacent heap metadata and objects are overwritten.
Heap corruption in a long-running network daemon typically causes daemon crashes, resulting in loss of the SMB service and potentially the router management plane. Deeper exploitation depends on heap layout and mitigations present in the specific RouterOS build.
Root Cause
The root cause is missing validation of the attacker-controlled uniPwdLen field before it participates in size arithmetic. The unchecked subtraction underflows and produces an oversized copy length. This pattern maps directly to [CWE-122].
Attack Vector
Exploitation requires network reachability to the SMB service on an affected RouterOS device. No authentication or user interaction is required. A single crafted SMB1 SessionSetupAndX packet is sufficient to trigger the corruption. Devices exposing SMB to untrusted networks, including the public internet, are at highest risk.
No public proof-of-concept exploit code is referenced in the advisory. See the Vulncheck Advisory on MikroTik for additional technical detail.
Detection Methods for CVE-2026-89028
Indicators of Compromise
- Unexpected crashes or restarts of the RouterOS SMB daemon in device logs
- Inbound SMB1 SessionSetupAndX requests containing anomalous uniPwdLen values
- SMB traffic to RouterOS devices from unexpected external sources on TCP/445
- Loss of SMB service availability without corresponding administrator action
Detection Strategies
- Inspect network traffic to RouterOS management interfaces for SMB1 protocol usage, which is legacy and should be rare in modern environments
- Alert on SMB SessionSetupAndX requests where uniPwdLen exceeds the actual payload length
- Correlate RouterOS daemon crash events with preceding SMB session-setup traffic
Monitoring Recommendations
- Enable centralized syslog forwarding from all MikroTik devices and monitor for SMB service faults
- Deploy network intrusion detection signatures targeting malformed SMB1 session-setup packets
- Track SMB exposure across the fleet using periodic external and internal port scans of TCP/445
How to Mitigate CVE-2026-89028
Immediate Actions Required
- Upgrade all MikroTik RouterOS devices to version 7.24 or later
- Disable the SMB service on RouterOS devices where file sharing is not required
- Restrict TCP/445 access to management networks only using RouterOS firewall rules
- Audit device inventories for RouterOS versions below 7.24 and prioritize internet-facing devices
Patch Information
MikroTik addressed the vulnerability in RouterOS 7.24. Refer to the MikroTik Forum Release Note for release details and download instructions. Apply the update through the standard RouterOS upgrade workflow and reboot the device to activate the patched SMB daemon.
Workarounds
- Disable the SMB service entirely with /ip smb set enabled=no when file sharing is not needed
- Block inbound TCP/445 at the perimeter firewall to prevent untrusted access to the SMB daemon
- Limit SMB access to trusted management subnets using RouterOS input chain firewall filters
# Configuration example: disable SMB and restrict TCP/445 on RouterOS
/ip smb set enabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=445 \
src-address-list=!trusted-mgmt action=drop comment="Block SMB from untrusted sources"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
