MikroTik RouterOS EUVD-2026-72025

No special configuration is required for the availability (kernel crash) attack: the Bandwidth Test server is enabled by default on RouterOS and listens on TCP port 2000, making any network-reachable RouterOS device exploitable by an unauthenticated remote attacker without any prior access or credentials. The packet-size integer underflow is triggered by attacker-controlled input, requiring no victim-side configuration. The memory disclosure variant requires the attacker to specify random-data=false in the btest session parameters, which is entirely attacker-controlled and not a victim configuration dependency. Exploitation is blocked for devices where: (1) the Bandwidth Test server has been explicitly disabled, (2) firewall rules block external access to TCP port 2000, or (3) RouterOS has been upgraded to 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable). Internet-exposed RouterOS devices with default configurations have no limiting factors.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H, score 8.8) accurately characterizes the threat: trivially exploitable from any network without authentication, user interaction, or special prerequisites. The high availability impact (VA:H) represents a complete denial-of-service against network infrastructure - crashing the router kernel disrupts all traffic flowing through it, making this especially severe for ISP and edge deployments. The low confidentiality impact (VC:L) reflects kernel buffer leakage, which may expose in-memory router data including credentials or configuration fragments. A public exploit is confirmed, and CERT-PL's 'actively exploited' advisory language elevates urgency significantly even without formal CISA KEV listing. The combination of no-auth network access, public exploit code, and probable active exploitation places this in the immediate-patch category for any internet-facing RouterOS device. The Bandwidth Test server is enabled by default on RouterOS, maximizing the exposed attack surface. No CVSS vector conflict exists; the described behavior fully supports the AV:N/PR:N rating.

An attacker with network access to RouterOS TCP port 2000 initiates a btest 'related' UDP connection without completing the normal authentication handshake, exploiting the pre-auth state acceptance flaw. The attacker then sends a crafted btest control packet with an inverted (negative) packet-size interval value, causing unsigned integer underflow in the RouterOS kernel's btest data path, generating anomalously oversized fragmented packets that crash the kernel and force a router restart, dropping all routed traffic. Separately, using the same pre-auth session with random-data=false, the attacker receives uninitialized kernel packet buffer contents, potentially leaking sensitive in-memory data. A public exploit and reverse-engineering writeup of the silent patch are available, lowering the technical bar for exploitation.