MikroTik RouterOS up to 6.49.18/7.11.2/7.23.x SMB1 SessionSetupAndX uniPwdLen integer underflow

Summaryinfo

A vulnerability was found in MikroTik RouterOS up to 6.49.18/7.11.2/7.23.x. It has been classified as critical. The impacted element is an unknown function of the component SMB1 SessionSetupAndX Handler. This manipulation of the argument uniPwdLen causes integer underflow. This vulnerability is tracked as CVE-2026-89028. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in MikroTik RouterOS up to 6.49.18/7.11.2/7.23.x. It has been declared as critical. Affected by this vulnerability is an unknown code block of the component SMB1 SessionSetupAndX Handler. The manipulation of the argument uniPwdLen with an unknown input leads to a integer underflow vulnerability. The CWE definition for the vulnerability is CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. As an impact it is known to affect availability. The summary by CVE is:

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a uniPwdLen field that triggers an integer underflow, causing the resulting value to be used as the copy length in a memory copy operation into a smaller heap buffer, corrupting adjacent heap memory.

It is possible to read the advisory at forum.mikrotik.com. This vulnerability is known as CVE-2026-89028 since 09/10/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 7.24.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• MikroTik

Name

• RouterOS

Version

• 6.49.0
• 6.49.1
• 6.49.2
• 6.49.3
• 6.49.4
• 6.49.5
• 6.49.6
• 6.49.7
• 6.49.8
• 6.49.9
• 6.49.10
• 6.49.11
• 6.49.12
• 6.49.13
• 6.49.14
• 6.49.15
• 6.49.16
• 6.49.17
• 6.49.18
• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8
• 7.9
• 7.10
• 7.11
• 7.11.0
• 7.11.1
• 7.11.2
• 7.12
• 7.13
• 7.14
• 7.15
• 7.16
• 7.17
• 7.18
• 7.19
• 7.20
• 7.21
• 7.22
• 7.23

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion