MikroTik RouterOS CVE-2026-89020

Exploitation requires a valid authentication credential on the target RouterOS device; read-only group membership is sufficient, so the attacker does not need administrator or write privileges. The attacker must have the ability to execute /tool fetch commands, accessible via SSH, the RouterOS API, or Winbox. No external infrastructure (TFTP server, network route) is required - the crash occurs entirely in the URL path processing stage before any network transaction. Limiting factors: authentication is mandatory (fully unauthenticated remote exploitation is not possible per the PR:L CVSS metric); the confirmed impact is a mtget worker process crash, not system-wide router failure or code execution; and exploitation requires issuing explicit commands rather than passively sending network packets, meaning passive network-level attackers cannot exploit this without first obtaining credentials.

The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VA:L accurately characterizes the constrained impact: network-reachable, low complexity, but requiring authentication and resulting only in a process-level availability impact. The PR:L metric is critical - read-only group membership is sufficient, meaning any account on the device (including monitoring or read-only API accounts) can trigger the crash, lowering the effective privilege bar considerably. VulnCheck's detailed technical write-up describing a deterministic overflow offset raises the theoretical possibility of a code-execution primitive on certain architectures, but no such capability has been demonstrated publicly; the confirmed impact remains DoS only. This vulnerability is not in CISA KEV and no public exploit code exists, so automated or opportunistic exploitation at scale is not currently a credible threat vector. EPSS data was not present in the available intelligence, preventing probability-based prioritization. Even a mid-sized municipal IT team in gdynia managing RouterOS infrastructure across campus edge routers should treat this as a routine patch-cycle item rather than an emergency response, given the authentication prerequisite and the self-limiting crash impact. MikroTik's broad ISP and enterprise deployment footprint does increase aggregate exposure if credential hygiene is poor, but the attack does not enable lateral movement or data exfiltration based on currently available data.

An attacker who has obtained read-only credentials for a MikroTik RouterOS device - via credential stuffing, leaked API tokens, or a compromised monitoring account - connects over SSH or the API and issues /tool fetch with a tftp:// URL whose path component is 507 or more characters. The mtget binary copies the path into a 528-byte stack buffer using an unbounded rep movsb, overwriting saved registers at a deterministic offset and crashing the mtget worker process immediately, without requiring any TFTP server to be running or reachable.