CVE-2026-67277
Description
CVE-2026-67277 is a high-severity MikroTik RouterOS vulnerability allowing unauthenticated remote kernel crashes and sensitive data disclosure.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| routeros | 6.0 | 6.49.21 | vulnerable |
| routeros | 7.0 | 7.23.4 | vulnerable |
| routeros | 7.24 | 7.24.2 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Download and install the latest security updates from MikroTik. The vendor has released specific patches to address the btest authentication bypass and integer underflow issues across their Long-term and Stable release channels.
Update affected systems
Upgrade all MikroTik RouterOS instances to version 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) or later. Systems running versions between 6.0 and 6.49.20, 7.0 and 7.23.3, or 7.24 and 7.24.1 are confirmed vulnerable.
Restrict access
Disable the Bandwidth Test (btest) server if it is not required for business operations. If the service must remain active, implement firewall rules to restrict access to UDP port 2000 to only trusted, authorized administrative IP addresses.
Monitor for exploitation
Analyze network traffic for anomalous UDP patterns and large fragmented packets targeting the btest service. Regularly review RouterOS system logs for unexpected kernel reboots or 'btest' session errors originating from unauthenticated sources.
Detection Guidance
"Security teams should monitor for unauthorized UDP traffic on port 2000, the default for the MikroTik Bandwidth Test protocol. Look for anomalous packet sizes or high volumes of fragmented UDP output, which may indicate an attempted integer underflow attack. Review device logs for frequent kernel restarts or unauthenticated btest session attempts. Network-based IDS signatures should be configured to identify 'related' btest connections that occur without a preceding authenticated primary session."