EUVD-2026-80701
GHSA-w9p3-2qvw-6779
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable pre-auth OOB read (AV:N/PR:N) yielding bounded memory disclosure (C:L) and possible daemon crash (A:L); no integrity impact and SMB-enabled prerequisite not modeled in 3.1 AC.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetupAndX frame. The out-of-bounds read occurs in the SessionSetupAndX handler before any credential validation, potentially exposing sensitive memory contents.
AnalysisAI
An out-of-bounds read in the userspace SMB daemon of MikroTik RouterOS before 7.24 allows unauthenticated remote attackers to read memory beyond the end of the request buffer by sending a minimal SMB1 SessionSetupAndX frame with a crafted uniPwdLen field value. The over-read occurs in the SessionSetupAndX handler before any credential validation, so no authentication or user interaction is required, though exploitation is only possible when the non-default SMB service is enabled and reachable on the network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The userspace SMB daemon/service must be enabled and network-reachable on the RouterOS device (SMB is not enabled by default), and the attacker must be able to reach its SMB1 SessionSetupAndX handler. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but limited-severity issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade affected devices to MikroTik RouterOS 7.24 or later; the vendor-released patch is the 7.24 stable build announced at https://forum.mikrotik.com/t/7-24-stable-is-released/272381, and additional detail is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/mikrotik-routeros-out-of-bounds-read-via-smb1-sessionsetupandx. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: k
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remot
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stor
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consu
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today