{"id":"CVE-2026-67277","kind":"vulnerability","aliases":["CVE-2026-67277"],"related":[],"title":"mikrotik routeros: RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication","description":"MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"RouterOS btest (bandwidth-test) service accepts a 'related' connection before the primary session authenticates. An unauthenticated remote client can start an IPv4 UDP test and read uninitialized kernel packet-buffer memory (random-data=false). An unchecked inverted packet-size interval causes an integer underflow that can restart the kernel. One of six CERT.pl 'MikroTrick' issues. CISA KEV lists it as exploited.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-09-10T00:00:00+00:00","products":[{"name":"RouterOS","fixed":["6.49.21","7.23.4","7.24.2","7.24.3","7.23.6"],"affected":">= 6.0.0, < 6.49.21; >= 7.0.0, < 7.23.4; >= 7.24, < 7.24.2","ecosystem":"vendor"},{"name":"mikrotik routeros","fixed":["6.49.21"],"affected":">= 6.0, < 6.49.21","ecosystem":"vendor"},{"name":"mikrotik routeros","fixed":["7.23.4"],"affected":">= 7.0, < 7.23.4","ecosystem":"vendor"},{"name":"mikrotik routeros","fixed":["7.24.2"],"affected":">= 7.24, < 7.24.2","ecosystem":"vendor"},{"name":"MikroTik RouterOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","mikrotik","network-edge","routeros","self-hosted"],"not_affected_if":["btest-disabled","btest-not-internet-reachable","btest-service-disabled","no-mikrotik-routeros","patched-7.24.2+"],"how_to_check":"Run /system resource print and compare the version with the fixed list. Affected: 6.0.0 to before 6.49.21, 7.0.0 to before 7.23.4, 7.24 to before 7.24.2. Run /tool bandwidth-server print to see whether the btest server is enabled, and check whether UDP/TCP 2000 is reachable from untrusted networks. runZero asset query: os:=\"MikroTik RouterOS\" AND version in the ranges above.","fix":"Upgrade to 7.24.3 (stable), 7.23.6 (long-term) or 6.49.21 or later. This fixes all six issues, including the incomplete certificate fix in 7.24.2 and 7.23.4. Until then, disable the btest server (/tool bandwidth-server set enabled=no) and block the btest port from untrusted networks. The vendor does not list this workaround, so it is a precaution. Inspect the config for unknown scripts and users, and check the log for a Flagged status.","status":"open","published_at":"2026-09-05T20:17:18+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:34+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T20:31:34Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor's fixed RouterOS release or mitigation (version not stated in the sources). Follow CISA BOD 26-04 guidance; discontinue use of the device if no mitigation is available.","summary":"MikroTik RouterOS has a missing-authentication flaw in the btest bandwidth-test service that lets an unauthenticated remote attacker read kernel memory and crash the service or device. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["mikrotik","routeros","self-hosted","network-edge"],"confidence":0.7,"analyst_note":"Find the affected and fixed RouterOS versions and whether btest is disabled by default, via the MikroTik changelog or the CVE record linked from the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["btest-service-disabled","no-mikrotik-routeros"],"severity_if_unknown":"high"},"cost_usd":0.000388,"input_tokens":2200,"output_tokens":336,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed RouterOS versions and whether btest is disabled by default, via the MikroTik changelog or the CVE record linked from the CISA KEV entry.","search":"'-04':147C,173C,204C '-2026':18A,21A '-67277':19A,22A '26':146C,172C,203C 'accept':4A,48B 'accord':136C 'action':132C 'adher':200C 'allow':118C 'appli':133C 'applic':170C 'asset':194C 'authent':16A,56B,112C 'bandwidth':45B 'bandwidth-test':44B 'base':151C 'bod':145C,171C,202C 'btest':7A,43B,128C 'buffer':73B 'caus':86B 'cert.pl':98B 'cisa':101B,130C,143C,160C 'client':60B 'cloud':176C 'complet':15A 'complianc':141C 'connect':8A,51B 'contain':109C 'correspond':11A 'critic':114C 'cve':17A,20A 'data':77B 'denial':123C 'disclosur':121C 'discontinu':179C 'edg':37B 'ensur':140C,199C 'evalu':192C 'exploit':32B,106B 'exposur':197C 'fals':78B 'follow':169C 'forens':162C 'function':115C 'guidanc':158C,174C 'guidelin':206C 'host':41B 'infrastructur':33B 'instruct':139C 'integ':88B 'internet':196C 'interv':85B 'invert':81B 'ipv4':64B 'issu':100B 'kernel':70B,94B,119C 'kev':102B 'list':103B 'memori':74B,120C 'mikrotik':1A,24A,26A,28A,30A,34B,107C 'mikrotrick':99B 'miss':111C 'mitig':134C,185C 'network':36B 'network-edg':35B 'note':157C,168C 'one':95B 'packet':72B,83B 'packet-buff':71B 'packet-s':82B 'patch':205C 'primari':12A,54B 'priorit':148C 'product':183C 'random':76B 'random-data':75B 'read':68B 'relat':6A,50B 'remot':59B 'requir':131C,164C 'respons':190C 'restart':92B 'risk':153C 'routero':2A,3A,38B,42B,108C 'routeros':23A,25A,27A,29A,31A 'secur':149C 'see':154C,165C 'self':40B 'self-host':39B 'servic':47B,125C,129C,177C 'session':13A,55B 'six':97B 'size':84B 'stakehold':188C 'start':62B 'test':46B,66B 'triag':163C 'udp':65B 'unauthent':58B 'unavail':187C 'uncheck':80B 'underflow':89B 'uniniti':69B 'updat':150C 'url':155C,166C 'use':180C 'vendor':138C 'vulner':116C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-05T20:17:18+00:00","kev":{"dateAdded":"2026-09-10","dueDate":"2026-09-13","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-67277","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277","severity":null,"published_at":"2026-09-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-67277:121","url":null,"severity":null,"published_at":"2026-10-23T21:39:15+00:00","modified_at":"2026-10-23T21:39:15+00:00","first_seen_at":"2026-10-23T21:39:15+00:00","fetched_at":"2026-10-23T21:39:15+00:00","note":"Read MikroTik advisory (Sep 3, updated Oct 6), CVE record, CERT.pl. Fixed 7.24.2/7.23.4/6.49.21; MikroTik recommends 7.24.3/7.23.6/6.49.21+ to cover the whole bundle. Btest default-enabled state not stated in sources read: unknown. Exploited per CISA KEV (Sep 10); MikroTik says the SSH bug CVE-2026-67279 was the one seen in the wild, and CERT.pl reports attacks chaining the SSH bugs. No public PoC found."},{"source":"nvd","external_id":"CVE-2026-67277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67277","severity":null,"published_at":"2026-09-05T20:17:18+00:00","modified_at":"2026-09-11T12:52:29+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":367,"url":"https://x.com/Shadowserver/status/2099173447507013658","title":"@Shadowserver: These should not be publicly accessible on the Internet due to potential vulnera","kind":"post","source":"x","text":"These should not be publicly accessible on the Internet due to potential vulnerabilities, such as the recent CVE-2026-67277 https://t.co/IiWG9VsMIU\n\nYou can find all our MikroTik detections in Device ID report https://t.co/1uPaaDBimE (around 3M daily): https://t.co/ilWjNmiz5k\n\nlikes 3 reposts 1","published_at":"2026-09-13T16:28:45+00:00","relation":"discussion","confidence":null,"note":"@Shadowserver"},{"id":827,"url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","title":"MikroTik: September 2026 vulnerability","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1168,"url":"https://www.cve.org/CVERecord?id=CVE-2026-67277","title":"CVE Record: CVE-2026-67277","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1166,"url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","title":"CERT.pl: MikroTrick, RouterOS vulnerabilities actively exploited","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1167,"url":"https://www.runzero.com/blog/mikrotik-routeros/","title":"runZero: MikroTik RouterOS, how to find impacted assets","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}