{"id":"CVE-2026-89020","title":"MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by sup…","summary":"MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by sup…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-121"],"vendor":"MikroTik","product":"RouterOS","affected":["RouterOS < 7.23.4","RouterOS >= 7.24.0 < 7.24.2"],"published":"2026-09-14","updated":"2026-09-16","sourceUpdated":"2026-09-16T17:18:17.367","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89020","references":[{"url":"https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801","label":"disclosure@vulncheck.com"},{"url":"https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/mikrotik-routeros-stack-buffer-overflow-via-tftp-url-path","label":"disclosure@vulncheck.com"},{"url":"https://mikrotik.com/supportsec/september-2026-vulnerability","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00286,"epssPercentile":0.21382,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-16T16:07:48.174278Z"},"ingestedAt":"2026-09-14T19:13:23.484Z","slug":"CVE-2026-89020","body":"## Overview\n\nMikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}