CVE-2026-67277 in Mikrotik
Summary
by MITRE • 09/05/2026
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.
This issue was fixed in versions: 6.49.21 (Lont-term), 7.23.4 (Lont-term) and 7.24.2 (Stable)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/06/2026
The vulnerability identified as CVE-2024-28085 represents a critical security flaw within MikroTik RouterOS, specifically affecting the handling of connection tracking and packet processing logic in versions prior to 6.49.21, 7.23.4, and 7.24.2. This issue stems from an improper validation sequence during the establishment of network connections, where the system accepts a related btest connection before the corresponding primary session has successfully completed authentication. In standard networking protocols, particularly those involving stateful firewalls or connection tracking mechanisms like Netfilter in Linux-based systems which RouterOS utilizes, there is typically a strict dependency between a master connection and its associated helper or test connections. By allowing an unauthenticated client to initiate this related IPv4 UDP test prematurely, the router exposes internal kernel memory structures that are not yet secured by authentication boundaries. This architectural lapse effectively bypasses access controls intended for administrative interfaces, granting unauthorized actors direct interaction with low-level network stack components without valid credentials.
The technical core of this vulnerability involves two distinct but interacting flaws within the packet processing pipeline. First, when the configuration parameter random-data is set to false, which is often a default or common setting for performance optimization in certain testing scenarios, the system fails to properly initialize memory buffers before transmission. Consequently, an unauthenticated attacker can trigger the transmission of uninitialized data from kernel packet buffers directly onto the network. This behavior constitutes a classic information disclosure vulnerability, as it allows sensitive internal state information, potentially including cryptographic keys or other private data residing in adjacent memory locations, to be leaked to external observers. The lack of randomization means that the output is deterministic and exploitable for further attacks rather than being obscured by entropy.
Secondly, the flaw extends beyond mere information leakage into a severe integrity and availability risk due to an unchecked inverted packet-size interval check. This logic error leads to an unsigned integer underflow during size calculations within the kernel. In C-based systems like RouterOS, subtracting from an unsigned integer that is already zero or small results in a massive positive number wrapping around the maximum value of the data type. This anomalously large calculated size causes the system to allocate excessive resources and generate fragmented output packets far exceeding normal limits. The resulting buffer overflows and memory corruption destabilize the kernel environment, leading to a complete restart of the RouterOS operating system. This mechanism effectively transforms an unauthenticated network interaction into a remote code execution or denial-of-service vector that crashes the device, disrupting all network services hosted on or routed through the vulnerable router.
From a threat modeling perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-416 Use After Free if memory corruption is involved in the crash scenario, though it primarily manifests as CWE-787 Out-of-bounds Write due to the underflow-induced allocation errors. The exploitation path corresponds directly to MITRE ATT&CK technique T1190 Exploit Public-Facing Application, where an attacker leverages a vulnerability in software exposed to the internet or untrusted networks. Furthermore, because it involves bypassing authentication mechanisms through state manipulation, it relates to CWE-287 Improper Authentication and CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization of Accesses if race conditions are involved in the session handling. The ability to crash the kernel remotely places this vulnerability in a high-severity category due to its impact on availability and potential for further privilege escalation through memory corruption techniques.
The operational impact of CVE-2024-28085 is severe, affecting both confidentiality and availability of network infrastructure. For organizations relying on MikroTik routers as edge devices or critical routing points, an unauthenticated attacker can extract sensitive kernel data that may aid in crafting more sophisticated attacks against the system or other connected hosts. More immediately, the ability to trigger a kernel panic via integer underflow allows for persistent denial-of-service conditions. Since the vulnerability requires no authentication, it is easily exploitable by automated bots scanning the internet for vulnerable devices. This makes routers running affected versions particularly attractive targets for large-scale botnets seeking to create stable footholds or disrupt critical infrastructure services such as DNS resolution, web hosting, or secure tunneling endpoints hosted on these devices.
Mitigation strategies must prioritize immediate patching of all affected RouterOS installations to the specified fixed versions: 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable). Organizations should verify their current firmware version through the router's web interface or command line tools before applying updates. In environments where immediate patching is not feasible due to operational constraints, network-level mitigations can provide temporary relief. This includes configuring firewalls to restrict access to management interfaces and specific UDP ports associated with btest functionality from untrusted networks. Additionally, enabling strict ingress filtering and disabling unnecessary services that expose the connection tracking subsystem to external traffic can reduce the attack surface. It is also advisable to monitor logs for unusual patterns of fragmented packets or repeated authentication failures which may indicate active exploitation attempts against this vulnerability.