Mikrotik RouterOS up to 6.49.20/7.23.3/7.24.1 integer underflow

Summaryinfo

A vulnerability classified as very critical has been found in Mikrotik RouterOS up to 6.49.20/7.23.3/7.24.1. This affects an unknown function. Performing a manipulation results in integer underflow. This vulnerability was named CVE-2026-67277. The attack may be initiated remotely. In addition, an exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Mikrotik RouterOS up to 6.49.20/7.23.3/7.24.1. It has been classified as very critical. This affects some unknown processing. The manipulation with an unknown input leads to a integer underflow vulnerability. CWE is classifying the issue as CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

It is possible to read the advisory at cert.pl. This vulnerability is uniquely identified as CVE-2026-67277 since 07/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but an exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/16/2026).

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 09/10/2026 with a due date of 09/13/2026:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BO

Upgrading to version 6.49.21, 7.23.4 or 7.24.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-72025). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Mikrotik

Name

• RouterOS

Version

• 6.49.0
• 6.49.1
• 6.49.2
• 6.49.3
• 6.49.4
• 6.49.5
• 6.49.6
• 6.49.7
• 6.49.8
• 6.49.9
• 6.49.10
• 6.49.11
• 6.49.12
• 6.49.13
• 6.49.14
• 6.49.15
• 6.49.16
• 6.49.17
• 6.49.18
• 6.49.19
• 6.49.20
• 7.23.0
• 7.23.1
• 7.23.2
• 7.23.3
• 7.24.0
• 7.24.1

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion