EUVD-2026-80702
GHSA-2jvh-jvq5-35jq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach RouterOS SMB port (445)
-
DeliverySend crafted SMB1 SessionSetupAndX
-
ExploitUnderflow uniPwdLen integer
-
ExecutionOversized memcpy into small heap buffer
-
PersistCorrupt adjacent heap
-
ImpactSMB daemon crash / DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the RouterOS SMB service (IP > SMB) to be enabled and network-reachable, with SMB1/legacy dialect handling active, so the SessionSetupAndX code path can be reached - SMB is not enabled by default on RouterOS, which is the primary limiting factor. When SMB is enabled, exploitation is remote and unauthenticated (PR:N/UI:N): the attacker simply sends a crafted SMB1 request with a malicious uniPwdLen value; no credentials or user interaction are needed. Affected: RouterOS before 7.24 (fixed in 7.24). The AT:P in the vendor vector suggests some condition (e.g., heap layout) affects reliable corruption. |
| Impact | This is a genuine unauthenticated network-reachable memory-corruption bug (CVSS 4.0 8.2, AV:N/AC:L/PR:N/UI:N) in RouterOS's userspace SMB daemon, reported by VulnCheck with a vendor patch already shipped in RouterOS 7.24. The vendor vector scores impact as availability-only (VC:N/VI:N/VA:H) with an attack requirement present (AT:P), meaning the demonstrated/claimed outcome is a heap-corruption-induced crash/DoS rather than confirmed code execution - despite the CWE-122 heap overflow class often being a code-execution primitive. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; the threat is currently theoretical/latent rather than confirmed active. The key real-world risk driver is not the CVSS number but exposure: RouterOS is very widely deployed, but the vulnerable SMB service is NOT enabled by default, which sharply narrows the realistically exploitable population. Note the availability-only scoring is a conservative floor - a heap-corruption bug of this type could plausibly be escalated to memory disclosure or RCE, so treat VA:H-only as the vendor's confirmed impact, not a guaranteed ceiling; verify with the VulnCheck advisory. |
| Exploit ScenarioDerived | An attacker with network reach to a RouterOS device that has the SMB service enabled sends a malformed SMB1 SessionSetupAndX request carrying a crafted uniPwdLen field that triggers an integer underflow, so an oversized length is used as the copy size into a smaller heap buffer, corrupting adjacent heap memory and crashing (or potentially destabilizing) the SMB daemon. No authentication or user interaction is required. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Heap memory corruption in the userspace SMB daemon of MikroTik RouterOS before 7.24 lets remote, unauthenticated attackers crash or destabilize the service by sending a crafted SMB1 SessionSetupAndX request whose uniPwdLen field triggers an integer underflow and an oversized copy into a smaller heap buffer (CWE-122). The independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as an availability-only impact - adjacent heap corruption in a userspace daemon, not a confirmed path to code execution - and the primary limiting factor is that the SMB service is not enabled by default on RouterOS. No public exploit code has been identified at time of analysis, and exploitation requires the SMB service to be enabled and network-reachable with legacy SMB1 dialect handling active; a vendor fix shipped in RouterOS 7.24.
RemediationAI
Vendor-released patch: upgrade RouterOS to 7.24 or later via the standard package update path (/system package update install or manual package upload), and verify the installed version after reboot; the fix is documented in MikroTik's 7.24 stable release thread at https://forum.mikrotik.com/t/7-24-stable-is-released/272381, with technical detail in the VulnCheck advisory at https://www.vulncheck.com/advisories/mikrotik-routeros-heap-corruption-via-smb1-sessionsetupandx. Because SMB is disabled by default, the highest-value compensating control is to leave it disabled or explicitly turn it off where file sharing is not required (under 'IP > SMB', set enabled=no), accepting that any SMB-dependent file-sharing or NAS workflow will break. Where SMB must stay enabled until patching is possible, restrict reachability with firewall rules that drop TCP 445 and 139 from untrusted zones and permit only specific management or storage subnets, understanding that this narrows but does not eliminate exposure from sources inside the permitted range; additionally, disabling legacy SMB1 dialect support where the implementation permits it removes the vulnerable SessionSetupAndX code path. Monitor the SMB daemon for crash/restart events as a possible indicator of attempted exploitation, and treat successful patching to 7.24 as the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RouterOS is MikroTik's Linux-based router/NAS operating system, and the affected component is its userspace SMB (SMB/CIFS file-sharing) daemon, which exposes the 'IP > SMB' service that administrators must explicitly enable. The bug lives in the SMB1 SessionSetupAndX request handler, part of the legacy SMB1 dialect code path. The attacker-supplied uniPwdLen field is used in a length computation that underflows (CWE-191-style integer bug feeding into CWE-122, a heap-based buffer overflow): the resulting underflowed value is passed as the copy length to a memory copy operation that writes into a heap buffer sized from a different, smaller calculation, so the copy overruns the allocation and corrupts adjacent heap metadata and objects. Because the corruption is in a userspace daemon rather than the kernel, and because the provided CVSS 4.0 vector records VC:N/VI:N/VA:H with AT:P, the demonstrated consequence is service crash/availability loss, with the AT:P (attack requirements present, e.g. heap layout) signaling that reliable exploitation is not trivial. CPE cpe:2.3:a:mikrotik:routeros:*:*:*:*:*:*:*:* with a wildcard version indicates all RouterOS releases prior to the fixed 7.24 build are in scope; reporting comes from VulnCheck.
Know when Routeros gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated remote request to the SMB daemon (AV:N/PR:N/UI:N); crafted length deterministically triggers the underflow (AC:L); confirmed impact is a crash, so A:H with C:N/I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a uniPwdLen field that triggers an integer underflow, causing the resulting value to be used as the copy length in a memory copy operation into a smaller heap buffer, corrupting adjacent heap memory.
Executive ViewAI
A memory-corruption flaw in the SMB service of MikroTik RouterOS (versions before 7.24) allows any network-reachable, unauthenticated party to crash or destabilize the router's file-sharing daemon. Because RouterOS powers edge routing, VPN, and branch connectivity for many organizations, an outage on these devices can interrupt business operations and remote access even though the defect does not permit data theft or code execution. Leadership should care because the fix is already available and the exposure is entirely configuration-dependent - organizations that have enabled legacy SMB on internet-facing routers carry the most risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: k
SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-a
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remot
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stor
Exploit-DB