Loading vulnerability…
Unauthenticated kernel-memory disclosure and denial of service in MikroTik RouterOS btest
CVE-2026-67277 is a missing-authentication vulnerability in the MikroTik RouterOS bandwidth-test (btest) service. RouterOS accepts a related btest connection before its corresponding primary session completes authentication, allowing an unauthenticated client to initiate an IPv4 UDP test. With random-data=false, the sender transmits an uninitialized tail from a kernel packet buffer, exposing kernel-memory contents. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and potentially a RouterOS kernel restart. Affected releases include RouterOS 6.0.0 through 6.49.20, 7.0.0 through 7.23.3, and 7.24 through 7.24.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote, unauthenticated attacker can disclose portions of uninitialized kernel packet-buffer memory, potentially revealing sensitive information, or cause denial of service by restarting the RouterOS kernel. Full administrative takeover is not established as an independent outcome of this vulnerability; descriptions of takeover involve other RouterOS vulnerabilities or inconsistently attributed exploit chains.
If you can’t patch tonight, do this now.
Until patching is complete, disable the bandwidth-test service where unnecessary. Otherwise, restrict btest access to trusted management networks and block or tightly filter traffic from untrusted networks. These exposure controls are temporary mitigations, not substitutes for updating.
Patch, then assume compromise.
Upgrade to RouterOS 6.49.21 Long-term, 7.23.4 Long-term, or 7.24.2 Stable, or a later fixed release appropriate to the deployed branch. RouterOS 7.25beta3 also contains the fix for the development branch. Verify the installed version after updating.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
61 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.