CVE-2026-89020 in MikroTik
Summary
by MITRE • 09/14/2026
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in MikroTik RouterOS versions prior to 7.23.4 on the long-term branch and 7.24.2 on the stable branch represents a critical stack-based buffer overflow within the mtget binary utility. This flaw is specifically located in the TFTP RRQ builder function, which processes Uniform Resource Locators passed via the /tool fetch command interface. The technical root cause stems from an insufficient bounds check when handling URL path strings that exceed 504 bytes in length. While the allocated stack buffer for this operation is sized at 528 bytes, the vulnerability manifests earlier due to how data is copied into memory using an unbounded rep movsb instruction sequence. This assembly-level copy mechanism fails to validate the input string against the available buffer space before initiating the transfer of data from source to destination addresses on the stack.
The operational impact of this flaw allows any authenticated user, including those with only read-only group membership privileges, to trigger a denial-of-service condition by crashing the mtget worker process. By supplying a crafted TFTP URL path that is 507 bytes or longer, an attacker can cause the first write operation outside the allocated buffer boundary to occur at exactly 505 bytes into the string. This out-of-bounds write overwrites saved registers and other critical stack metadata located at deterministic offsets relative to the buffer start. The immediate consequence of this memory corruption is a segmentation fault or similar crash within the mtget process, leading to service disruption for any network management tasks relying on that specific utility instance. Notably, the exploit does not require the attacker to have access to an actual TFTP server nor does it demand elevated administrative privileges, significantly lowering the barrier to entry for malicious actors targeting managed router infrastructure.
From a classification perspective, this vulnerability aligns with CWE-121, which denotes stack-based buffer overflow conditions where local variables are overwritten due to excessive input data. The exploitation technique leverages deterministic memory layout properties typical of x86 architectures, allowing precise control over the crash state through offset manipulation rather than arbitrary code execution in its current manifestation. In terms of adversary behavior mapping under MITRE ATT&CK, this activity corresponds to T1499 Endpoint Denial of Service, specifically categorized under resource hijacking or service disruption tactics where an attacker targets specific system processes to degrade availability without necessarily compromising confidentiality or integrity at the data level. The reliance on authenticated access places it within lateral movement or initial access vectors depending on how credentials were obtained, but the core technical flaw remains a classic memory safety violation common in legacy C/C++ network utilities that lack modern compiler protections like stack canaries enabled by default for all build configurations.
Mitigation strategies must prioritize immediate patching to the specified fixed versions of RouterOS, as no reliable workaround exists within the vulnerable code path other than restricting access to the /tool fetch command interface entirely if possible. Network segmentation should be employed to limit which hosts or user accounts can invoke network utility commands on affected devices. Additionally, enabling strict input validation at higher-level application layers before passing data down to system binaries like mtget can provide a secondary defense-in-depth measure. Security monitoring tools should be configured to detect unusual spikes in process termination events associated with the mtget binary, which may indicate ongoing exploitation attempts against unpatched systems. Organizations managing large fleets of MikroTik infrastructure must treat this as high-priority due to the low privilege requirement and the straightforward nature of the exploit vector involving standard command-line interfaces accessible via SSH or API endpoints exposed to authenticated users.