Listen to this Post
CVE-2026-67277 affects MikroTik RouterOS, specifically the btest bandwidth testing service.
RouterOS accepts a “related” btest connection before the corresponding primary session has completed authentication.
This ordering flaw lets an unauthenticated client enter a state normally reserved for an authenticated primary session.
From that state, the client can start an IPv4 UDP test.
The UDP test path can be reached without completing the expected authentication checks.
When the test option random-data=false is used, the sender does not fill the payload with random bytes.
Instead, the sender transmits an uninitialized tail copied from a kernel packet buffer.
That tail may contain stale kernel memory from prior operations.
This creates an information disclosure risk because packet bytes may expose kernel memory contents.
A separate defect exists in the packet-size interval handling.
The interval check is unchecked and inverted.
Because of the inversion, an unsigned integer underflow can occur.
The underflow leads to anomalously large fragmented output.
The oversized fragmented output can exhaust resources or trigger kernel instability.
In severe cases, it can restart the RouterOS kernel.
The vulnerability maps to CWE-306: Missing Authentication for Critical Function.
CERT.PL is the source for the CVE record and related advisories.
The issue was fixed in RouterOS 6.49.21 on the Long-term branch.
The issue was fixed in RouterOS 7.23.4 on the Long-term branch.
The issue was fixed in RouterOS 7.24.2 on the Stable branch.
Affected 6.x versions are from 6.0 up to, but excluding, 6.49.21.
Affected 7.x versions are from 7.0 up to, but excluding, 7.23.4.
Affected 7.24 versions are from 7.24 up to, but excluding, 7.24.2.
NVD published the CVE on September 5, 2026.
NVD last modified the record on September 11, 2026.
CISA added it to the Known Exploited Vulnerabilities Catalog on September 10, 2026.
CISA set a due date of September 13, 2026.
Required action is to apply mitigations per vendor instructions.
If mitigations are unavailable, discontinue use or follow BOD 26-04 guidance.
Internet exposure should be evaluated before patching decisions.
DailyCVE Form:
Platform: MikroTik RouterOS
Version: 6.0, 7.0, 7.24
Vulnerability : Missing Authentication
Severity: Critical
date: 2026-09-05
Prediction: 2026-09-13
(end of form)
What Undercode Say:
Analytics:
Check RouterOS version /system resource print /system routerboard print Check btest service availability /ip service print /tool bandwidth-server print Capture btest traffic on Linux sudo tcpdump -ni any 'tcp port 2000 or udp port 2000' -w routeros-btest.pcap Inspect UDP payloads for uninitialized tail patterns tshark -r routeros-btest.pcap -Y udp -T fields -e data.data Verify fixed versions 6.49.21 Long-term, 7.23.4 Long-term, 7.24.2 Stable
How Exploit: (Educational Purposes!)
Educational lab only; do not run against systems you do not own. Observe btest primary session handshake and related connection ordering. sudo tcpdump -ni eth0 'tcp port 2000 or udp port 2000' Use RouterOS btest client to initiate a UDP test in a controlled lab. btest -c 192.0.2.10 -U -r false -t 5 Monitor kernel messages for instability or restart. dmesg -w
Protection: from this CVE Impact:
Upgrade RouterOS /system package update check-for-updates /system package update install If upgrade is not possible, disable or restrict btest. /ip service disable btest /ip firewall filter add chain=input protocol=tcp dst-port=2000 action=drop comment="block btest tcp" /ip firewall filter add chain=input protocol=udp dst-port=2000 action=drop comment="block btest udp" Restrict management access and use trusted admin allowlists. /ip service disable telnet,ftp,www,api,api-ssl
Impact:
Unauthenticated information disclosure from kernel packet buffer tail. Unsigned integer underflow in packet-size interval handling. Anomalously large fragmented output. Resource exhaustion and RouterOS kernel restart. Internet-exposed btest services are at highest risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
