Listen to this Post
RouterOS accepts a “related” btest connection before the corresponding primary session has completed authentication.
An unauthenticated client can use this state to start an IPv4 UDP test.
With “random-data=false”, the sender transmits an uninitialized tail from a kernel packet buffer.
A separate unchecked, inverted packet-size interval causes unsigned integer underflow.
The underflow produces anomalously large fragmented output.
The malformed output can restart the RouterOS kernel.
The related btest connection is accepted too early.
The primary session does not need to finish authentication.
The IPv4 UDP test path is reachable pre-auth.
The uninitialized kernel packet buffer tail is not zeroed.
The packet-size interval logic mishandles the inverted bounds.
Unsigned integer arithmetic wraps instead of rejecting.
Fragmentation expands the malformed size.
Kernel restart leads to availability loss.
Memory disclosure leads to confidentiality loss.
CVSS 4.0 score is 8.8.
Severity is HIGH.
Vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N.
The issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable).
Finder credit is Sławomir Rozbicki (CERT.PL).
References include CERT.PL advisories.
References include NPRatley reversing analysis.
References include MikroTik vendor advisory.
References include MikroTik forum release notes.
The vulnerability combines information disclosure and denial of service.
The information disclosure is Low confidentiality impact.
The denial of service is High availability impact.
Integrity impact is None.
Scope impact is None for subsequent systems.
The attack vector is Network.
Attack complexity is Low.
Attack requirements are None.
Privileges required are None.
User interaction is None.
DailyCVE Form:
Platform: MikroTik RouterOS
Version: 6.49.21 7.23.4 7.24.2
Vulnerability : Unauthenticated btest underflow
Severity: HIGH
date: September 2026
Prediction: September 2026
What Undercode Say:
Analytics:
tcpdump -ni any 'tcp port 2000 or udp' python3 - <<'PY' size = 0 interval = -1 frag = size + interval print(frag) PY
Exploit: (Educational Purposes!)
nc -u <target> <port>
Protection: from this CVE
/system package update check-for-updates /system package update install
Impact:
Confidentiality: Low Availability: High Integrity: None Scope: Unchanged
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
