CVE-2026-67277: MikroTik RouterOS btest Vulnerability Exploited in the Wild; Kernel Memory Leak and Device Crash
CERT.PL disclosed CVE-2026-67277 in the MikroTik RouterOS btest service: missing authentication, CVSS 8.8. Unauthenticated attackers can read kernel memory or crash the kernel. Exploited in the wild and listed in KEV. Fixes: 6.49.21 / 7.23.4 / 7.24.2.
Poland's national CERT (CERT.PL) and MikroTik disclosed CVE-2026-67277 in RouterOS in early September: the bandwidth-test service btest accepts related connections before the main session finishes authentication. An unauthenticated remote attacker can read kernel memory or trigger an integer underflow that reboots the RouterOS kernel. ENISA and EU CSIRTs Network KEV records confirm in-the-wild exploitation; CISA-side records synced on 5 September. Official fixes 6.49.21, 7.23.4 (Long-term), and 7.24.2 (Stable) shipped around 3 September.
Incident Overview
CVE-2026-67277 was reported by CERT.PL researcher Sławomir Rozbicki. CVSS 4.0 score 8.8 (High). Class: missing authentication for critical function (CWE-306). Affected: RouterOS 6.0.0 through 6.49.20, 7.0.0 through 7.23.3, and 7.24 through 7.24.1—essentially all shipping MikroTik routers. CERT.PL also published a companion advisory stating RouterOS vulnerabilities are under active exploitation. Independent reverse engineering of the silent patch in RouterOS 7.23.4 (MikroTrick) further reconstructed the mechanism. Public sources have not disclosed victim counts or attacker targeting.
Technical Details
The bug is in btest (bandwidth test) session-state handling: RouterOS accepts a related btest connection before the corresponding main session has finished authentication. An unauthenticated client can use that state to start an IPv4 UDP test. With `random-data=false`, the sender emits uninitialized tail data from the kernel packet buffer as-is—kernel memory disclosure. A second, unchecked, direction-reversed packet-size range triggers unsigned integer underflow, producing abnormally large fragment output that can reboot the RouterOS kernel. Combined primitives: same bug is both recon and DoS. No authentication at any step.
Impact Assessment
RouterOS devices are heavily internet-exposed—high-value targets. Compromising the router enables traffic hijack, MITM, or a pivot. KEV listing plus CERT.PL's in-the-wild confirmation moves this from theory to live threat. Unpatched devices are in an active exploit window. Kernel memory leak can feed follow-on exploits with address data; kernel crash drops the network. Direct impact for SMBs and ISPs using MikroTik for egress or core links.
Remediation
- Upgrade RouterOS immediately to 6.49.21, 7.23.4 (Long-term), or 7.24.2 (Stable). 6.x users should plan migration.
- Temporary mitigation: unused bandwidth-test devices should disable btest in the IP Service List. If required, firewall the btest port to trusted management segments.
- Audit internet exposure: confirm Winbox, SSH, API, and other management services are not directly internet-facing. Collapse management entry points.
- Detection: watch unauthorized-source UDP sessions to the btest port, unexplained reboots, and out-of-band traffic anomalies. Correlate firewall logs for scanning.
- Track CERT.PL and MikroTik advisories for a possible second fix wave (CERT.PL advisory covers multiple bugs).
References
- CERT.PL: RouterOS vulnerabilities exploited in the wild
- MikroTik official security advisory
- CVE-2026-67277 details page