CVE-2026-93345 Overview
CVE-2026-93345 is an improper input validation vulnerability [CWE-1284] in MikroTik RouterOS versions before 7.25beta4. The flaw resides in the labelled-VPN Network Layer Reachability Information (NLRI) iterators of the routing service. An unauthenticated on-path attacker can crash the Border Gateway Protocol (BGP) service by sending a malformed MP_REACH_NLRI UPDATE message. The message carries a prefix-length value below the minimum valid for a labelled-VPN NLRI, which passes validation while describing a route with a negative-length address portion.
Critical Impact
A single crafted BGP UPDATE packet with a VPNv4 or VPNv6 NLRI can indefinitely hold down the BGP plane, terminating sessions without a NOTIFICATION message and causing a service malfunction on the device.
Affected Products
- MikroTik RouterOS versions before 7.25beta4
- Devices operating BGP with VPNv4 address family enabled
- Devices operating BGP with VPNv6 address family enabled
Discovery Timeline
- 2026-09-22 - CVE-2026-93345 published to the National Vulnerability Database
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93345
Vulnerability Analysis
The vulnerability affects how the RouterOS routing service iterates over labelled-VPN NLRI structures during processing of Multiprotocol BGP UPDATE messages. When the routing daemon parses an MP_REACH_NLRI attribute containing a VPNv4 or VPNv6 prefix, the prefix-length field is not checked against the minimum valid length required for labelled-VPN NLRI encoding. A prefix-length value below this minimum bypasses the validation logic but yields a negative-length address portion during subsequent iteration. This inconsistency triggers a service malfunction that terminates the BGP session without emitting the standard NOTIFICATION message required by the protocol.
An attacker can weaponize this by transmitting a single crafted UPDATE packet on an established BGP session. Repeated delivery holds the BGP plane down indefinitely, preventing route convergence and disrupting connectivity for downstream VPN customers.
Root Cause
The root cause is missing bounds enforcement in the labelled-VPN NLRI iterator. Labelled-VPN NLRI encodings carry an MPLS label stack and a Route Distinguisher in addition to the IP prefix, so the effective minimum prefix-length is greater than that of a plain IPv4 or IPv6 NLRI. The routing service accepts prefix-length values below this minimum, producing a negative computed address length that the iterator does not handle safely.
Attack Vector
Exploitation requires an on-path position where the attacker can send BGP UPDATE messages to the target router. This typically means an existing BGP peering relationship or the ability to inject packets into an established BGP session. No authentication is required beyond the BGP transport itself, and no user interaction is needed. Further technical detail is available in the VulnCheck Advisory on MikroTik DoS.
Detection Methods for CVE-2026-93345
Indicators of Compromise
- Unexpected termination of BGP sessions on RouterOS devices without a preceding BGP NOTIFICATION message.
- Recurring routing service restarts or malfunction events in RouterOS system logs.
- Inbound BGP UPDATE messages containing VPNv4 or VPNv6 NLRI with prefix-length values below the minimum valid for labelled-VPN encoding.
Detection Strategies
- Deploy BGP protocol-aware inspection on peering links to flag MP_REACH_NLRI attributes carrying out-of-bounds prefix-length values.
- Monitor BGP session state transitions and alert when sessions drop without a matching NOTIFICATION event.
- Correlate routing daemon crash indicators with peer session flaps to identify patterns consistent with exploitation attempts.
Monitoring Recommendations
- Enable syslog forwarding from RouterOS devices to a centralized log platform for routing service events.
- Instrument BGP telemetry (BMP or streaming telemetry) to capture UPDATE message contents for offline validation.
- Track baseline BGP session uptime and generate alerts on abnormal flap frequency on VPNv4 or VPNv6 address families.
How to Mitigate CVE-2026-93345
Immediate Actions Required
- Upgrade affected RouterOS devices to version 7.25beta4 or later as documented in the MikroTik Forum Release Notes.
- Audit BGP peering configurations and restrict VPNv4 and VPNv6 address families to trusted peers only.
- Verify TCP-AO or MD5 authentication is enforced on all BGP sessions to reduce packet injection risk.
Patch Information
MikroTik addressed the vulnerability in RouterOS 7.25beta4. Operators running earlier 7.x releases should plan an upgrade window and validate BGP session stability after deployment. Refer to the MikroTik Forum Release Notes for full release details.
Workarounds
- Apply inbound BGP policies that filter or reject UPDATE messages containing malformed VPNv4 or VPNv6 NLRI where the platform supports such filtering.
- Disable VPNv4 and VPNv6 address families on BGP sessions where labelled-VPN routing is not required.
- Terminate BGP sessions with untrusted or externally reachable peers until the patch is applied.
# Configuration example: verify RouterOS version and disable unused BGP address families
/system resource print
/routing bgp connection disable [find where address-families~"vpnv4|vpnv6"]
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
