{"id":"CVE-2026-67277","title":"RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication","summary":"RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits a…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":["CWE-306"],"vendor":"mikrotik","product":"routeros","affected":["routeros >= 6.0, < 6.49.21","routeros >= 7.0, < 7.23.4","routeros >= 7.24, < 7.24.2"],"patched":["routeros 7.24.2"],"published":"2026-09-05","updated":"2026-09-11","sourceUpdated":"2026-09-11T12:52:29.533","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67277","references":[{"url":"https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve","label":"cvd@cert.pl"},{"url":"https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/","label":"cvd@cert.pl"},{"url":"https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","label":"cvd@cert.pl"},{"url":"https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801","label":"cvd@cert.pl"},{"url":"https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800","label":"cvd@cert.pl"},{"url":"https://mikrotik.com/supportsec/september-2026-vulnerability/","label":"cvd@cert.pl"},{"url":"https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/","label":"cvd@cert.pl"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67277","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","in-the-wild","exploit-available","kev"],"exploited":true,"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-10T19:48:06.780837Z"},"scores":{"nvd":8.2,"cna":8.8},"epss":0.00869,"epssPercentile":0.56738,"kev":true,"kevDateAdded":"2026-09-10","kevDueDate":"2026-09-13","kevRansomware":false,"ingestedAt":"2026-09-06T10:53:52.381Z","slug":"CVE-2026-67277","body":"## Overview\n\nRouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.\n\n\n\nThis issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)\n\n## Affected\n\n- `routeros >= 6.0, < 6.49.21`\n- `routeros >= 7.0, < 7.23.4`\n- `routeros >= 7.24, < 7.24.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `routeros 7.24.2`","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":45.1,"likelihood":0.2,"exploitation":25,"ransomware":0},"changes":[{"seq":201860,"id":"CVE-2026-67277","ts":1789399915169,"field":"exploit_available","old":"false","new":"true"},{"seq":201859,"id":"CVE-2026-67277","ts":1789399915169,"field":"exploited","old":"false","new":"true"},{"seq":201858,"id":"CVE-2026-67277","ts":1789399915169,"field":"kev","old":"false","new":"true"},{"seq":201857,"id":"CVE-2026-67277","ts":1789399915169,"field":"cvss","old":"8.8","new":"8.2"},{"seq":200590,"id":"CVE-2026-67277","ts":1789397462634,"field":"exploit_available","old":"true","new":"false"},{"seq":200589,"id":"CVE-2026-67277","ts":1789397462634,"field":"exploited","old":"true","new":"false"},{"seq":200588,"id":"CVE-2026-67277","ts":1789397462634,"field":"kev","old":"true","new":"false"},{"seq":200587,"id":"CVE-2026-67277","ts":1789397462634,"field":"cvss","old":"8.2","new":"8.8"},{"seq":198507,"id":"CVE-2026-67277","ts":1789392047895,"field":"exploit_available","old":"false","new":"true"},{"seq":198506,"id":"CVE-2026-67277","ts":1789392047895,"field":"exploited","old":"false","new":"true"},{"seq":198505,"id":"CVE-2026-67277","ts":1789392047895,"field":"kev","old":"false","new":"true"},{"seq":198504,"id":"CVE-2026-67277","ts":1789392047895,"field":"cvss","old":"8.8","new":"8.2"},{"seq":196298,"id":"CVE-2026-67277","ts":1789383663269,"field":"exploit_available","old":"true","new":"false"},{"seq":196297,"id":"CVE-2026-67277","ts":1789383663269,"field":"exploited","old":"true","new":"false"},{"seq":196296,"id":"CVE-2026-67277","ts":1789383663269,"field":"kev","old":"true","new":"false"},{"seq":196295,"id":"CVE-2026-67277","ts":1789383663269,"field":"cvss","old":"8.2","new":"8.8"},{"seq":195227,"id":"CVE-2026-67277","ts":1789380514104,"field":"exploit_available","old":"false","new":"true"},{"seq":195226,"id":"CVE-2026-67277","ts":1789380514104,"field":"exploited","old":"false","new":"true"},{"seq":195225,"id":"CVE-2026-67277","ts":1789380514104,"field":"kev","old":"false","new":"true"},{"seq":195224,"id":"CVE-2026-67277","ts":1789380514104,"field":"cvss","old":"8.8","new":"8.2"},{"seq":194014,"id":"CVE-2026-67277","ts":1789378599807,"field":"exploit_available","old":"true","new":"false"},{"seq":194013,"id":"CVE-2026-67277","ts":1789378599807,"field":"exploited","old":"true","new":"false"},{"seq":194012,"id":"CVE-2026-67277","ts":1789378599807,"field":"kev","old":"true","new":"false"},{"seq":194011,"id":"CVE-2026-67277","ts":1789378599807,"field":"cvss","old":"8.2","new":"8.8"},{"seq":192801,"id":"CVE-2026-67277","ts":1789376444842,"field":"exploit_available","old":"false","new":"true"},{"seq":192800,"id":"CVE-2026-67277","ts":1789376444842,"field":"exploited","old":"false","new":"true"},{"seq":192799,"id":"CVE-2026-67277","ts":1789376444842,"field":"kev","old":"false","new":"true"},{"seq":192798,"id":"CVE-2026-67277","ts":1789376444842,"field":"cvss","old":"8.8","new":"8.2"},{"seq":191588,"id":"CVE-2026-67277","ts":1789373519140,"field":"exploit_available","old":"true","new":"false"},{"seq":191587,"id":"CVE-2026-67277","ts":1789373519140,"field":"exploited","old":"true","new":"false"},{"seq":191586,"id":"CVE-2026-67277","ts":1789373519140,"field":"kev","old":"true","new":"false"},{"seq":191585,"id":"CVE-2026-67277","ts":1789373519140,"field":"cvss","old":"8.2","new":"8.8"},{"seq":190373,"id":"CVE-2026-67277","ts":1789369394210,"field":"exploit_available","old":"false","new":"true"},{"seq":190372,"id":"CVE-2026-67277","ts":1789369394210,"field":"exploited","old":"false","new":"true"},{"seq":190371,"id":"CVE-2026-67277","ts":1789369394210,"field":"kev","old":"false","new":"true"},{"seq":190370,"id":"CVE-2026-67277","ts":1789369394210,"field":"cvss","old":"8.8","new":"8.2"},{"seq":189160,"id":"CVE-2026-67277","ts":1789368317039,"field":"exploit_available","old":"true","new":"false"},{"seq":189159,"id":"CVE-2026-67277","ts":1789368317039,"field":"exploited","old":"true","new":"false"},{"seq":189158,"id":"CVE-2026-67277","ts":1789368317039,"field":"kev","old":"true","new":"false"},{"seq":189157,"id":"CVE-2026-67277","ts":1789368317039,"field":"cvss","old":"8.2","new":"8.8"},{"seq":187943,"id":"CVE-2026-67277","ts":1789365184576,"field":"exploit_available","old":"false","new":"true"},{"seq":187942,"id":"CVE-2026-67277","ts":1789365184576,"field":"exploited","old":"false","new":"true"},{"seq":187941,"id":"CVE-2026-67277","ts":1789365184576,"field":"kev","old":"false","new":"true"},{"seq":187940,"id":"CVE-2026-67277","ts":1789365184576,"field":"cvss","old":"8.8","new":"8.2"},{"seq":186730,"id":"CVE-2026-67277","ts":1789363375771,"field":"exploit_available","old":"true","new":"false"},{"seq":186729,"id":"CVE-2026-67277","ts":1789363375771,"field":"exploited","old":"true","new":"false"},{"seq":186728,"id":"CVE-2026-67277","ts":1789363375771,"field":"kev","old":"true","new":"false"},{"seq":186727,"id":"CVE-2026-67277","ts":1789363375771,"field":"cvss","old":"8.2","new":"8.8"},{"seq":185516,"id":"CVE-2026-67277","ts":1789361163047,"field":"exploit_available","old":"false","new":"true"},{"seq":185515,"id":"CVE-2026-67277","ts":1789361163047,"field":"exploited","old":"false","new":"true"}]}