> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# MikroTik RouterOS
- URL: https://f4n6.co.uk/security-feed/mikrotik-routeros/
- Published: 2026-09-29T23:52:28.000Z
- Updated: 2026-09-29T23:52:28.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

CISA published ICSA-26-272-06 on 2026-09-29 covering CVE-2026-84411, an integer underflow (CWE-191) in the MikroTik RouterOS web management service that is reachable before authentication and rated CVSS v3.1 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A single crafted HTTP request can execute arbitrary code as root or crash the device. Affected versions are RouterOS below 7.24; MikroTik directs users to 7.23 or later, while the GitHub advisory for the related btest flaw names 7.23.4 and 7.24.2 as the fixed builds. CISA states no known public exploitation targeting this vulnerability at this time, and the VERIFIED REFERENCE DATA supplied with this item resolved no CISA KEV entry for CVE-2026-84411, so this is not a confirmed exploited-in-the-wild event. The exposure is nonetheless material for EMEA financial services because RouterOS sits at the network edge in branch, ATM, kiosk and remote-office roles, where an unauthenticated root compromise of the router is a direct path to the internal network.

## 2\. Regulatory framing

| Article            | Trigger (the fact in this item)                                                                                              | Practical impact                                                                                                                                                                  |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28       | RouterOS is an ICT third-party product used at the network edge; the fix is a vendor-supplied firmware upgrade from MikroTik | Firms must confirm the RouterOS estate is inside the ICT third-party register and that the contract with the reseller or managed provider carries upgrade and support obligations |
| NIS2 Art. 21(2)(d) | A pre-authentication remote code execution flaw in an internet-reachable network device is a supply chain security exposure  | Entities in scope must be able to evidence that edge-device firmware is inventoried, monitored for vendor advisories, and patched under a defined process                         |

No DORA incident-reporting article is engaged on the facts available: CISA records no known public exploitation, and this advisory does not describe a confirmed incident at any client. If a client finds exploitation, DORA Art. 17, 18 and 19 and NIS2 Art. 23 become live at that point.

## 3\. Technical analysis & attack chain

The flaw is an integer underflow in the HTTP request body handling of the RouterOS web management service. The vulnerable code path is reachable before authentication, so no credentials, session or prior interaction are required. CISA rates the impact as arbitrary code execution as root, or denial of service, from a single crafted request. The relevant weakness is CWE-191 Integer Underflow (Wrap or Wraparound).

Confirmed steps, as far as the sources support them:

1. The attacker reaches the RouterOS web management service over the network. The CVSS v3.1 vector is AV:N, so the service is treated as network-reachable; CISA's standing guidance is to keep these devices off the public internet.
2. The attacker sends a crafted HTTP request whose body triggers an integer underflow in the request body handling routine.
3. The underflow is processed before any authentication check, so the attacker does not need valid credentials.
4. The result is either arbitrary code execution in the root context of the device, or a denial of service that takes the router down.

The sources do not describe the exact request body, the length or offset that triggers the underflow, the memory layout, or a proof-of-concept. Do not expect to reproduce this from the advisory alone; treat the vendor fix as the only reliable remediation.

Affected and fixed versions, as stated across the sources:

| Item                                               | Version                                                  |
| -------------------------------------------------- | -------------------------------------------------------- |
| Affected                                           | RouterOS < 7.24                                          |
| Vendor fix (CISA advisory)                         | RouterOS 7.23 or later                                   |
| Fixed builds (GitHub advisory, related btest flaw) | 6.49.21 (Long-term), 7.23.4 (Long-term), 7.24.2 (Stable) |

The version guidance is inconsistent between the CISA advisory and the GitHub advisory. CISA says 7.23 or later; the GitHub advisory for the btest issue names 7.23.4 and 7.24.2\. The safe reading is to move to 7.24.2 (Stable) or 7.23.4 (Long-term) rather than to 7.23 generally, and to confirm the target build against MikroTik's own release notes before scheduling.

Related RouterOS issues in the same window, which matter because they compound the exposure on the same devices:

- CVE-2026-67277, missing authentication for a critical function in the btest service, allowing kernel memory disclosure and denial of service. This one carries a CISA KEV entry with a remediation due date of 2026-09-13 and required action under BOD 26-04\. Known ransomware campaign use is recorded as Unknown. The GitHub advisory GHSA-6q2x-6fhj-r3w8 describes the mechanism: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication, an unauthenticated client can start an IPv4 UDP test, and with "random-data=false" the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. Fixed in 6.49.21, 7.23.4 and 7.24.2.
- ICSA-26-209-05, CWE-307 improper restriction of excessive authentication attempts in the RouterOS API, CVSS v3.1 8.8 HIGH. No fix was available at publication; MikroTik recommended a VPN or additional protection layer in front of any publicly exposed API, restricting management access to trusted networks, and long randomly generated passwords. A fixed per-connection delay exists in some versions but can be bypassed with concurrent sessions.
- ICSA-26-211-01, CWE-613 insufficient session expiration in the RouterOS API, CVSS v3.1 4.9 MEDIUM. Sessions retain their previous permission set after inactivity timeouts or user-group changes, so a user whose permissions were reduced can keep accessing information. MikroTik's guidance is to fully log the affected user out when permissions are downgraded.

Confidence caveats. The CVE identifier CVE-2026-84411 and the affected range RouterOS < 7.24 come from the CISA advisory and its external mirror; the primary item text supplied to us does not carry the CVE number, so the mapping of the integer underflow to CVE-2026-84411 rests on the CISA page. The btest mechanism detail is single-sourced to the GitHub advisory GHSA-6q2x-6fhj-r3w8; verify before using it to build detection logic. The German BSI advisories WID-SEC-2026-3366 and WID-SEC-2026-3193 describe multiple RouterOS vulnerabilities in general terms and do not add version or mechanism detail. No actor, campaign or attribution is named in any source, and the VERIFIED REFERENCE DATA resolved no MITRE ATT&CK profile, so there is no attribution to report.

## 4\. Mitigation & containment

P1 (within 24 hours)

- Inventory every RouterOS and Cloud Hosted Router device in the estate, including branch, ATM, kiosk, remote-office and any device managed by a third party. Record the running version for each.
- Remove internet exposure from the RouterOS web management service and the API. CISA's standing guidance is to keep these devices off the public internet, place them behind a firewall and isolate them from business networks. Where remote administration is required, put it behind a VPN and keep the VPN itself patched.
- For any device that cannot be patched immediately, block inbound access to the web management service at the perimeter and at the host firewall, and restrict management to a trusted LAN port.
- Treat CVE-2026-67277 as already overdue: the CISA KEV due date was 2026-09-13\. Confirm btest is not exposed and that the device is on a fixed build.

P2 (within 72 hours)

- Upgrade RouterOS to 7.24.2 (Stable) or 7.23.4 (Long-term). Do not stop at 7.23 generally; the GitHub advisory names 7.23.4 as the fixed Long-term build. Long-term branch users on 6.x should move to 6.49.21 at minimum, and to a 7.x fixed build where the hardware supports it.
- Download firmware only from https://mikrotik.com/download and verify the package before applying.
- Apply the ICSA-26-209-05 mitigations on any device with the API enabled: restrict management services to trusted networks, apply firewall rules to control access, and set the unsuccessful-attempt time range (0.1 to 0.5 seconds) in /ip service for all services including the API once the option is available on the running build.
- Replace weak or default-simple administrative passwords with long randomly generated ones, and keep the default randomly generated device password or replace it with an equally strong one, since minimum complexity is not enforced by default.
- Where a user's permissions are downgraded, log that user out fully so the new policy takes effect (ICSA-26-211-01).

P3 (within 7 days)

- Add RouterOS firmware version to the asset inventory and to the vulnerability management feed, with a defined cadence for checking MikroTik releases.
- Confirm the third-party register and the contract with any managed service provider cover firmware upgrade responsibility and support for these devices (DORA Art. 28).
- Review logs for the period before patching for signs of unauthenticated access attempts against the web management service and the API.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The sources name no hashes, domains, IP addresses, file paths, registry keys or command lines. CISA states no known public exploitation targeting this vulnerability has been reported.

The sources do describe observable behaviours worth hunting for. These are behavioural, not atomic, and are not suitable for the copyable block.

| Behaviour                                                                                                 | Where to observe                                                    | Confidence                                                                         |
| --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| Unauthenticated requests reaching the RouterOS web management service from outside the management network | Perimeter firewall and router logs, HTTP request logs on the device | High for the exposure pattern; the sources do not give a request signature         |
| RouterOS device restart or unexpected reboot                                                              | Device uptime, syslog, SNMP traps, availability monitoring          | Medium; the kernel restart is described for the btest flaw, not for CVE-2026-84411 |
| High-volume authentication failures against the RouterOS API without lockout or rate-limiting response    | RouterOS logs, authentication logs forwarded to SIEM                | High; described in ICSA-26-209-05                                                  |
| API session continuing to access resources after a permission downgrade or inactivity timeout             | RouterOS logs correlated with user-group change records             | Medium; described in ICSA-26-211-01                                                |
| btest service accepting a "related" connection before the primary session authenticates                   | RouterOS logs, network flow records for the btest service           | Single-sourced to GHSA-6q2x-6fhj-r3w8; verify before enforcement                   |

## 6\. Detection

The sources give no file artefacts, command lines, mutexes, registry keys or hard-coded values for CVE-2026-84411\. There is nothing to build a YARA rule from, and a rule keyed on the CVE identifier or the product name would detect reporting about the flaw rather than the flaw itself. No YARA rule is emitted.

The behavioural material supports a Sigma rule for the API brute-force pattern described in ICSA-26-209-05\. The field names below are generic; map them to the client's RouterOS log schema before deployment.

```yaml
title: MikroTik RouterOS API Authentication Failures Without Lockout
id: 8f2c1a44-7b6e-4d21-9c3a-0e5b7d9a1f60
status: experimental
description: Detects repeated failed authentication attempts against the MikroTik RouterOS API, consistent with the missing rate-limiting and lockout described in CISA ICSA-26-209-05.
author: Adverse Trace
date: 2026-09-29
references:

  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-05
logsource:
  product: mikrotik
  service: routeros
detection:
  selection:
    action|contains:

      - 'login failure'
      - 'login failed'
  timeframe: 5m
  condition: selection | count() by src_ip > 20
falsepositives:

  - Misconfigured management scripts using stale credentials
  - Vulnerability scanners performing authenticated checks
level: high

```

## 7\. Sources

- CISA, MikroTik RouterOS (ICSA-26-272-06), https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06, 2026-09-29
- CISA, MikroTik RouterOS (external mirror of ICSA-26-272-06), https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06, 2026-09-29
- NVD, CVE-2026-67277 MikroTik RouterOS missing authentication for critical function, https://nvd.nist.gov/vuln/detail/CVE-2026-67277
- GitHub Security Advisories, RouterOS btest related-connection authentication bypass (GHSA-6q2x-6fhj-r3w8), https://github.com/advisories/GHSA-6q2x-6fhj-r3w8
- CISA, MikroTik RouterOS and Cloud Hosted Router (ICSA-26-209-05), https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-05
- CISA, MikroTik RouterOS (ICSA-26-211-01), https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-01, 2026-07-30
- BSI Germany, MikroTik RouterOS: Mehrere Schwachstellen (WID-SEC-2026-3366), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3366
- BSI Germany, MikroTik RouterOS: Mehrere Schwachstellen (WID-SEC-2026-3193), https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3193

## 8\. Adverse Trace position

Adverse Trace assesses CVE-2026-84411 as critical on technical severity (CVSS v3.1 9.8, pre-authentication remote code execution as root) but not as a confirmed exploited-in-the-wild event: CISA records no known public exploitation, and the VERIFIED REFERENCE DATA supplied with this item resolved no CISA KEV entry for this CVE. The separate btest flaw CVE-2026-67277 is a KEV entry with a due date of 2026-09-13 and should be treated as the more urgent of the two on the same devices. Client impact is concentrated in firms running RouterOS at the network edge, where an unauthenticated root compromise of the router is a direct path inward; the affected version range and the conflicting fix guidance (7.23 or later versus 7.23.4 and 7.24.2) mean version confirmation is the first task, not the last. We will track MikroTik's release notes for a corrected fixed-version statement, watch for exploitation reporting that would move CVE-2026-84411 into KEV, and reissue this advisory if either changes. Clients who find unauthenticated access attempts against the RouterOS web management service should treat them as a potential incident and contact us before closing them out.

---

[Read the original source →](https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*