Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-67277

Kernel memory disclosure and denial of service in MikroTik RouterOS btest service

CVSS 4.0 8.8 HIGHCheck source for fixed versionsCISA KEV

Original advisory

cve-program · CVE-2026-67277

Published

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-67277

Published

RouterOS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Mikrotik",
                    "product": "RouterOS",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "7.24",
                            "lessThan": "7.24.2",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "7.0.0",
                            "lessThan": "7.23.4",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "6.0.0",
                            "lessThan": "6.49.21",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON