MikroTik RouterOS Authentication Bypass, Kernel Panic, and Info Leak (CVE-2026-67277) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTMikroTik RouterOS versions 6.x and 7.x prior to specific patched releases.
Unauthenticated attackers can exploit the bandwidth test (btest) feature to leak kernel memory or cause a Denial of Service (DoS) via kernel restart.
Apply security patches (6.49.21, 7.23.4, 7.24.2 or later) and disable the bandwidth test server.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Firmware Upgrade: Immediately update to the following fixed versions:
- v6.49.21 (Long-term)
- v7.23.4 (Long-term)
- v7.24.2 (Stable)
- Temporary Mitigation (Disable BTest Server): If patching is not immediately possible, disable the vulnerable service:
/tool bandwidth-server set enabled=no- Firewall Restriction: Block access to the bandwidth test port (default TCP/UDP 2000) from untrusted networks:
/ip firewall filter add action=drop chain=input dst-port=2000 protocol=tcp
/ip firewall filter add action=drop chain=input dst-port=2000 protocol=udpStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
This vulnerability stems from a design flaw in the MikroTik RouterOS Bandwidth Test (btest) protocol. The system erroneously accepts 'related' connections before the primary session has completed authentication. An unauthenticated client can exploit this state to initiate an IPv4 UDP test. When 'random-data' is set to false, the sender transmits uninitialized tail data from kernel packet buffers, leading to information disclosure. Furthermore, an unchecked packet-size interval causes an unsigned integer underflow, resulting in anomalously large fragmented output that triggers a kernel crash (DoS). This issue is listed in CISA's KEV catalog and has an EPSS score of 0.94, indicating high exploitation probability.
Official Vendor Advisories & References
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.