--- id: "CVE-2026-67277" kind: "vulnerability" aliases: ["CVE-2026-67277"] title: "mikrotik routeros: RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication" severity: "high" cvss: 8.8 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "RouterOS", "fixed": ["6.49.21", "7.23.4", "7.24.2", "7.24.3", "7.23.6"], "affected": ">= 6.0.0, < 6.49.21; >= 7.0.0, < 7.23.4; >= 7.24, < 7.24.2", "ecosystem": "vendor"}, {"name": "mikrotik routeros", "fixed": ["6.49.21"], "affected": ">= 6.0, < 6.49.21", "ecosystem": "vendor"}, {"name": "mikrotik routeros", "fixed": ["7.23.4"], "affected": ">= 7.0, < 7.23.4", "ecosystem": "vendor"}, {"name": "mikrotik routeros", "fixed": ["7.24.2"], "affected": ">= 7.24, < 7.24.2", "ecosystem": "vendor"}, {"name": "MikroTik RouterOS", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "infrastructure", "mikrotik", "network-edge", "routeros", "self-hosted"] not_affected_if: ["btest-disabled", "btest-not-internet-reachable", "btest-service-disabled", "no-mikrotik-routeros", "patched-7.24.2+"] published_at: "2026-09-05T20:17:18+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:39:15+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67277", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # mikrotik routeros: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication RouterOS btest (bandwidth-test) service accepts a 'related' connection before the primary session authenticates. An unauthenticated remote client can start an IPv4 UDP test and read uninitialized kernel packet-buffer memory (random-data=false). An unchecked inverted packet-size interval causes an integer underflow that can restart the kernel. One of six CERT.pl 'MikroTrick' issues. CISA KEV lists it as exploited. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:RouterOS affected >= 6.0.0, < 6.49.21; >= 7.0.0, < 7.23.4; >= 7.24, < 7.24.2 fixed 6.49.21, 7.23.4, 7.24.2, 7.24.3, 7.23.6 - vendor:mikrotik routeros affected >= 6.0, < 6.49.21 fixed 6.49.21 - vendor:mikrotik routeros affected >= 7.0, < 7.23.4 fixed 7.23.4 - vendor:mikrotik routeros affected >= 7.24, < 7.24.2 fixed 7.24.2 - vendor:MikroTik RouterOS affected ? fixed ? ## How to check Run /system resource print and compare the version with the fixed list. Affected: 6.0.0 to before 6.49.21, 7.0.0 to before 7.23.4, 7.24 to before 7.24.2. Run /tool bandwidth-server print to see whether the btest server is enabled, and check whether UDP/TCP 2000 is reachable from untrusted networks. runZero asset query: os:="MikroTik RouterOS" AND version in the ranges above. ## Fix Upgrade to 7.24.3 (stable), 7.23.6 (long-term) or 6.49.21 or later. This fixes all six issues, including the incomplete certificate fix in 7.24.2 and 7.23.4. Until then, disable the btest server (/tool bandwidth-server set enabled=no) and block the btest port from untrusted networks. The vendor does not list this workaround, so it is a precaution. Inspect the config for unknown scripts and users, and check the log for a Flagged status. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277 - 2026-10-23T21:39:15+00:00 analyst — Read MikroTik advisory (Sep 3, updated Oct 6), CVE record, CERT.pl. Fixed 7.24.2/7.23.4/6.49.21; MikroTik recommends 7.24.3/7.23.6/6.49.21+ to cover the whole bundle. Btest default-enabled state not stated in sources read: unknown. Exploited per CISA KEV (Sep 10); MikroTik says the SSH bug CVE-2026-67279 was the one seen in the wild, and CERT.pl reports attacks chaining the SSH bugs. No public PoC found. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67277 ## Documents - [advisory] MikroTik: September 2026 vulnerability https://mikrotik.com/supportsec/september-2026-vulnerability/ - [describes] CVE Record: CVE-2026-67277 https://www.cve.org/CVERecord?id=CVE-2026-67277 - [describes] CERT.pl: MikroTrick, RouterOS vulnerabilities actively exploited https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ - [discussion] @Shadowserver: These should not be publicly accessible on the Internet due to potential vulnera https://x.com/Shadowserver/status/2099173447507013658 - [mentions] runZero: MikroTik RouterOS, how to find impacted assets https://www.runzero.com/blog/mikrotik-routeros/ ## From the sources MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_