CVE-2026-67277

Executive Summary

CVE-2026-67277 is an authentication-bypass and memory-safety vulnerability in MikroTik RouterOS affecting the Bandwidth Test ("btest") protocol implementation. An unauthenticated remote attacker can establish a "related" btest session before the primary session completes authentication, enabling the attacker to initiate IPv4 UDP traffic tests without credentials. The flaw combines two distinct memory-safety defects — an uninitialized memory disclosure (via kernel packet buffer tail) and an integer underflow triggered by an unchecked inverted packet-size interval — potentially resulting in kernel-level instability or denial of service. While no public exploit code or CISA KEV listing exists at the time of writing, the attack surface (publicly exposed RouterOS devices on ports 8291 and 20561) is significant given the widespread deployment of MikroTik devices in enterprise and ISP environments.

Technical Analysis

The vulnerability resides in the RouterOS Bandwidth Test (btest) service, a feature used for throughput measurement between RouterOS devices or between a RouterOS device and a client tool. The NVD description provides two distinct defect classes:

Defect 1 — Authentication State Bypass (CWE-306): The btest service accepts a session flagged as "related" before the corresponding primary session completes authentication. The protocol architecture of btest splits control channels and test data channels; a "related" connection appears to be tied to an existing session identifier rather than undergoing independent authentication. This allows an unauthenticated client to reference a primary session in a pre-authentication state, thereby inheriting or implying privileges it has not yet earned. The consequence is that the attacker bypasses the authentication gate entirely and proceeds to initiate an IPv4 UDP test session.

Defect 2 — Uninitialized Memory Disclosure: When the test is configured with "random-data=false," the sender transmits payload data sourced from a kernel packet buffer tail region that was never initialized. Instead of zero-or-randomizing buffer contents, the implementation copies the full packet length from a slab/kernel memory region, leaking residual kernel memory contents across the network. While the primary security impact is information disclosure of kernel heap contents, this can reveal sensitive kernel pointers, process data, or other pending network payloads from prior sessions.

Defect 3 — Unsigned Integer Underflow Corrupting Packet Assembly: A separate code path validates a "packet-size interval" value but fails to reject an inverted range (where the lower bound exceeds the upper bound). The subtraction of a larger unsigned value from a smaller unsigned value triggers an unsigned integer underflow, producing a near-maximum 32-bit value. This anomalously large value is then used as the size parameter for fragmented output assembly, causing the fragmentation routine to allocate or chain an excessive number of fragments. This condition is further reported to be capable of restarting the RouterOS kernel — a deliberate hard-reset behavior that the operating system triggers on irrecoverable memory corruption conditions, effectively converting this flaw into a remote denial-of-service vector.

The combination is notable: the authentication bypass (Defect 1) is the gateway; Defect 3 is the kernel-crash trigger; Defect 2 is a supplementary data exfiltration channel. The "related" session mechanism may be an artifact of the protocol's design for multi-session telemetry, where a secondary data channel is associated with the primary control session — but the implementation fails to gate child sessions on the parent's authentication state.

Attack Surface

The btest service listens on ports commonly used by RouterOS management protocols (8291 for Winbox; the btest protocol also operates over UDP and TCP on dynamically negotiated ports). The service is reachable from the WAN interface on countless misconfigured or intentionally exposed MikroTik devices. Given the prevalence of MikroTik in SMB, ISP, and enterprise edge routing, the attack surface is substantial.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance / Target Identification: An attacker scans the public IPv4 space (or uses Shodan with product:"RouterOS") for hosts with the btest service exposed on TCP/UDP port 20561 or with related management ports accessible (8291/TCP Winbox). The attacker fingerprints the RouterOS version via banner grabbing or the Winbox protocol. Targets running versions prior to 6.49.21, 7.23.4, or 7.24.2 are flagged as potentially vulnerable.

Step 2 — Triggering the Authentication Bypass: The attacker initiates a btest protocol handshake with the victim. Rather than completing the authentication exchange, the attacker transmits a "related" session establishment packet, referencing a session ID that either does not exist or is in a pre-authentication state. The RouterOS service accepts this association and elevates the new session without performing credential verification. No username, password, or pre-shared key is required.

Step 3 — Payload Execution at the Vulnerability-Class Level: With bypassed authentication, the attacker has the ability to issue btest commands. To exploit the integer-underflow condition, the attacker instructs the service to begin an IPv4 UDP test with a crafted packet-size interval where the lower bound is numerically greater than the upper bound. The resulting unsigned subtraction wraps, generating an enormous size value that the fragmentation engine processes into absurdly large output — exhausting the device's memory or corrupting packet assembly structures. Separately, by setting "random-data=false," the attacker receives a stream of data where each packet's payload tail contains uninitialized kernel buffer memory. The attacker captures and reassembles these fragments to exfiltrate raw kernel memory content.

Step 4 — Post-Exploitation Impact: Upon triggering the integer-underflow packet fragmentation path, the RouterOS kernel detects corruption (via its internal watchdogs) and self-restarts, causing a denial of service for all routed traffic through the device — including NAT, firewall, and VPN services. If the attacker opts for the memory-disclosure path, collected data may reveal kernel pointers (useful for further kernel exploitation), credentials from other in-flight sessions, or internal routing data. The authentication bypass itself provides a foothold for additional probing of other RouterOS services (e.g., attempting default credentials or known post-auth CVEs).

Impact Assessment

Technical Impact: The vulnerability enables two distinct post-exploitation outcomes: (1) remote kernel denial of service via forced restart, and (2) uninitialized kernel-memory disclosure. In a worst-case scenario where the disclosed memory contains authentication tokens or secrets, the attacker could escalate to further compromise of the device's administrative plane — though the NVD description does not explicitly provide a path from memory disclosure to code execution; that should not be assumed.

Business Impact: MikroTik RouterOS devices are used as enterprise edge routers, CPE (customer premises equipment) at ISPs, and in wireless ISP (WISP) backhauls. A remote DoS on an edge router halts all traffic passing through the device, which can interrupt Internet connectivity for an entire office, branch location, or thousands of residential customers in ISP deployments. The memory disclosure only intensifies the risk: kernel heap addresses may leak pointers to sensitive data structures, which can later be combined with other flaws.

Blast Radius: Widely distributed. MikroTik has a large worldwide install base; the default configurations rarely restrict btest to LAN interfaces, making many devices accidentally WAN-exposed. The lack of authentication requirements for this flaw raises the exploitability score, but the absence of a CVSS vector (N/A per data) and no confirmed public exploitation prevent precise impact quantification. As this CVE was fixed in multiple release trains (6.49.x Long-term and 7.23.x/7.24.x), the vulnerable population is legacy-version users who have not applied Long-term updates.

Detection Guidance

Detection of this flaw is challenging because legitimate btest traffic uses the same protocol structure. The key differentiators are: (1) "related" session establishment without prior successful authentication, (2) anomalous UDP test sessions from unexpected source IPs, and (3) packet-size intervals where min-size > max-size, followed by abnormally large fragmented packet storms.

Sigma Rule

title: Suspicious RouterOS Bandwidth Test Session Without Authentication
id: 3f9c6a2e-8b1d-4c5e-9a7b-2d4f1c8e6a00
status: experimental
description: Detects RouterOS btest related-session establishment or anomalous UDP test activity indicative of CVE-2026-67277 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-67277
author: Valtersit Threat Intelligence
date: 2026/06/15
logsource:
    category: firewall
    product: mikrotik
detection:
    selection_related:
        event.action: 'new_connection'
        destination.port: 20561
        # 'related' state implies no prior established authenticated session
        connection.state: 'related'
    selection_anomaly:
        event.action: 'new_connection'
        destination.port: 20561
        # Packets per second abnormally high for UDP data test
        network.packets_per_second: '>10000'
        # Source IP not in authorized admin list
    filter_known_admin:
        source.ip:
            - '10.0.0.0/8'
            - '192.168.0.0/16'
    condition: (selection_related or selection_anomaly) and not filter_known_admin
level: high
falsepositives:
    - Legitimate administrative btest from statically configured peers
fields:
    - source.ip
    - destination.ip
    - source.port
    - destination.port

YARA Rule

rule RouterOS_CVE_2026_67277_MemDisclosure_Traffic
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects uninitialized kernel memory disclosure pattern in RouterOS btest UDP payloads"
        cve = "CVE-2026-67277"
        date = "2026-06-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-67277"

    strings:
        // RouterOS btest protocol header magic (protocol-specific framing pattern)
        $btest_magic = { 3A 1B 00 01 }
        // Repeated long runs of 0x00 or 0xFF in non-random-data mode (uninitialized tail)
        $zero_run = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $ff_run   = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF }
        // Common kernel heap poison values (x86 and ARM architectures)
        $poison_01 = { 01 01 01 01 01 01 01 01 }
        $poison_5a = { 5A 5A 5A 5A 5A 5A 5A 5A }

    condition:
        uint16(0) == 0x3A1B and
        (
            #zero_run >= 4 or
            #ff_run >= 4 or
            #poison_01 >= 2 or
            #poison_5a >= 2
        )
}

Note: The YARA rule above targets network-captured btest traffic. Since exact protocol framing bytes for this flaw are unavailable, the rule promotes high false positives but serves as a hunt-aid for unusual payloads.

Suricata IDS Rule

alert udp any any -> any 20561 (msg:"MikroTik RouterOS CVE-2026-67277 Potential Exploitation"; 
    flow:to_server;
    content:"|3a 1b|"; depth:2;
    content:"|00 01|"; offset:2; depth:2;
    # Detect oversized UDP packet lengths for the btest data plane
    dsize:>1450; 
    # Anomalous time to trigger buffer underflow - min packet size interval inverted
    metadata:cve CVE-2026-67277;
    reference:url, https://nvd.nist.gov/vuln/detail/CVE-2026-67277;
    classtype:attempted-dos; 
    sid: 2026061501; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where destination.port == 20561 and network.transport == "udp" and event.action == "connection_attempted"]
  [network where destination.port == 20561 and network.transport == "udp" and network.bytes > 1400 and event.action == "connection_accepted"]
  [network where destination.port == 20561 and network.transport == "udp" and network.packets > 10000 and network.bytes > 15000000]

Splunk SPL Query

index=firewall sourcetype=fortigate OR sourcetype=cisco:asa
| where dest_port=20561
| eval session_key = src_ip + ":" + src_port + "->" + dest_ip + ":" + dest_port
| stats count as packet_count, sum(bytes) as total_bytes, dc(session_state) as state_variety 
     by src_ip, dest_ip, session_key
| where packet_count > 10000 or total_bytes > 50000000
| table _time, src_ip, dest_ip, session_key, packet_count, total_bytes, state_variety
| sort - total_bytes

Wazuh OSSEC Rule

<group name="routeros,">
  <rule id="100501" level="12">
    <decoded_as>json</decoded_as>
    <field name="dest_port">^20561$</field>
    <field name="protocol">udp</field>
    <description>MikroTik RouterOS btest excessive traffic from single source - possible CVE-2026-67277 exploitation</description>
    <group>routeros_exploit,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED per tracked sources. Despite the vendor releasing fixed versions listed in the description (6.49.21, 7.23.4, 7.24.2), the patch-confidence scoring shows no evidence from tracker sources — a discrepancy worth validating by confirming the router's running version against the fixed release train.

Immediate Mitigations:

1. Access Control: Immediately restrict access to the btest service (port 20561/TCP+UDP) and the Winbox management port (8291/TCP) to trusted administrative IP ranges only. Apply this via the RouterOS firewall (/ip firewall filter) or at the upstream network boundary.
2. Disable the Service: If the Bandwidth Test feature is not operationally required, disable it entirely. In RouterOS, kill any active btest server process and remove scheduler entries that may restart it.
3. Network Segmentation: Move RouterOS management interfaces onto a dedicated VLAN or management-only subnet with no WAN reachability.

Patch/Upgrade Steps:

1. Back up configuration (/system backup save).
2. Upgrade to the nearest fixed release, preferring Long-term builds: RouterOS 6.49.21 (for 6.x users) or RouterOS 7.23.4/7.24.2 (for 7.x users). Download from the official MikroTik download page.
3. Verify the upgrade: /system resource print (confirm version). Confirm checksum of the uploaded package (SHA-256) against MikroTik's published sums to avoid tampered images.

Long-Term Hardening:

• Subscribe to MikroTik's security announcement mailing list to receive timely advisory notifications.
• Establish a patch-management window for network gear; MikroTik releases Long-term and Stable branches — pick one and adhere to its update cadence.
• Implement NetFlow/IPFIX export on the edge router to retain traffic metadata for the btest port and enable retrospective analysis after security events.
• Perform periodic internal and external penetration tests targeting management-plane protocols (Winbox, API, btest) to discover exposure drift.
• Where feasible, phase out the legacy btest tool in favor of alternative bandwidth-testing utilities (e.g., iperf3) that run on separate, non-management infrastructure.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-67277
2. MikroTik RouterOS Changelog (stable/long-term): https://mikrotik.com/download/changelogs
3. MikroTik Security Advisory Page (vendor advisories): https://mikrotik.com/support/security
4. CWE-306 (Missing Authentication for Critical Function): https://cwe.mitre.org/data/definitions/306.html

Threat Actor Campaigns / ITW Evidence: At the time of writing, no known threat-actor campaigns exist referencing CVE-2026-67277. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, and no exploit code or Nuclei template has been publicly released. The description severity and the historical targeting of MikroTik devices by botnets (e.g., Mēris in 2021) imply that weaponization of this flaw is plausible once reverse-engineering of the fixed binaries occurs — SOC teams should monitor for anomalous UDP traffic to port 20561 even in the absence of a public PoC.