MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
TL;DR 📌
- MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.
- Highest CVSS: 8.2 (High).
- Listed in CISA KEV (2026-09-10) — this is being exploited in the wild.
- Fixed in
6.49.21,7.23.4,7.24.2— upgrade to this release or later. - CVEs: CVE-2026-67277.
What it is
CVE-2026-67277 sits in the btest service in RouterOS, MikroTik’s bandwidth-testing tool. The flaw is a missing authentication check: RouterOS accepts a “related” btest connection before the corresponding primary session has finished authenticating. This lets an unauthenticated client on the network start an IPv4 UDP test against the device without ever completing a valid login.
Two separate bugs compound from that entry point. First, when a test is run with random-data=false, RouterOS fills outgoing packets with an uninitialised tail taken directly from a kernel packet buffer, which discloses kernel memory contents to the client. Second, an unchecked and inverted packet-size interval causes an unsigned integer underflow, producing anomalously large fragmented output. This can crash and restart the RouterOS kernel, i.e. a denial of service.
The access path is network-based, no privileges and no user interaction required (AV:N/PR:N/UI:N), which is reflected in the CVSS score of 8.2. Impact is confidentiality (kernel memory disclosure) and availability (kernel restart), with no integrity impact recorded.
CVE-2026-67277 is listed in the CISA Known Exploited Vulnerabilities catalogue, added 10 September 2026.
What to do
- Upgrade RouterOS to one of the fixed releases: 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable), depending on which branch you run.
- Because this is in the CISA KEV catalogue, treat patching as urgent rather than routine maintenance.
- Until upgraded, restrict or disable access to the btest service from untrusted networks; there is no legitimate reason for it to be reachable from the WAN.
- Review firewall rules on affected devices to confirm the btest service is not exposed beyond the management network, since the vulnerability requires only network reachability and no authentication.
- After patching, confirm the running version against the fixed releases above rather than relying on an “up to date” flag, given the bug spans multiple long-term and stable branches.
For leadership 🧭
Executive summary. An unauthenticated attacker who can reach a RouterOS device’s btest service can read fragments of kernel memory and trigger a kernel restart, with no login required. This is already listed in CISA’s Known Exploited Vulnerabilities catalogue, so treat it as urgent rather than something for the next routine patch cycle.
Why it matters:
- The flaw lets an unauthenticated client start an IPv4 UDP btest session before the device finishes authenticating the primary connection, bypassing login entirely.
- With random-data=false, RouterOS fills test packets with an uninitialised tail from a kernel packet buffer, exposing kernel memory contents to whoever ran the test.
- A separate inverted packet-size check causes an integer underflow and oversized fragmented output that can crash and restart the RouterOS kernel, an outage on any router reachable for this service.
- CVE-2026-67277 is in the CISA KEV catalogue (added 10 September 2026), and the CVSS score of 8.2 reflects that no privileges or user interaction are needed over the network.
Now / Next / Later:
- Now: Identify every RouterOS device and confirm whether the btest service is reachable from outside the management network, then restrict or disable it immediately on anything internet- or WAN-facing.
- Next: Upgrade all affected devices to the fixed release for their branch: 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable), and verify the running version directly rather than trusting an update-available flag.
- Later: Add btest and similar diagnostic services to firewall baselines so they are scoped to management networks by default, and check running versions against fixed releases as a standing step after every RouterOS upgrade cycle.