EUVD-2026-80701
GHSA-w9p3-2qvw-6779
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach RouterOS SMB1 service (TCP 445)
-
ExploitCraft SessionSetupAndX with oversized uniPwdLen
-
ExecutionTrigger out-of-bounds read in handler
-
ImpactLeak adjacent process memory or crash daemon
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The userspace SMB daemon/service must be enabled and network-reachable on the RouterOS device (SMB is not enabled by default), and the attacker must be able to reach its SMB1 SessionSetupAndX handler. No authentication is required (PR:N) because the out-of-bounds read occurs before any credential validation, and no user interaction is needed. The primary limiting factor is the non-default SMB configuration (reflected by AT:P); impact is further bounded to a limited memory over-read (VC:L) and possible service disruption (VA:L) rather than code execution or full memory disclosure. |
| Impact | This is a genuine but limited-severity issue. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L) describes a network-reachable, pre-authentication out-of-bounds read that leaks limited memory (VC:L) and can degrade availability (VA:L, likely a crash of the SMB daemon), with no integrity impact - hence the moderate 6.3 score rather than a critical rating. The AT:P (attack requirement present) metric and the description together confirm exploitation depends on the userspace SMB daemon being enabled and reachable, which is NOT a RouterOS default. Exploitation status is 'no public exploit identified at time of analysis': there is no CISA KEV listing, no EPSS score, and no POC in the provided data - only a VulnCheck advisory describing the flaw. The pre-credential-validation nature (bug triggers before any authentication) makes it broadly triggerable where SMB is exposed, but the low confidentiality yield (bounded over-read of a request buffer, not arbitrary memory) keeps real-world priority moderate. No data conflicts are present: description (unauthenticated) and CVSS (PR:N) agree. Treat as a patch-in-normal-cycle issue, prioritized higher only where SMB is intentionally enabled and internet-exposed. |
| Exploit ScenarioDerived | An attacker who can reach the RouterOS SMB service (TCP 445) sends a minimal SMB1 SessionSetupAndX frame with a crafted uniPwdLen field larger than the actual request buffer. The daemon reads past the buffer end before validating credentials, returning adjacent process memory that may contain fragments of sensitive data, or crashing the SMB service. No public exploit code is identified at time of analysis; the flaw was reported by VulnCheck. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
An out-of-bounds read in the userspace SMB daemon of MikroTik RouterOS before 7.24 allows unauthenticated remote attackers to read memory beyond the end of the request buffer by sending a minimal SMB1 SessionSetupAndX frame with a crafted uniPwdLen field value. The over-read occurs in the SessionSetupAndX handler before any credential validation, so no authentication or user interaction is required, though exploitation is only possible when the non-default SMB service is enabled and reachable on the network. Vendor-released patch: RouterOS 7.24; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the independent assessment rates the impact as limited memory disclosure (VC:L) with possible service disruption (VA:L) rather than code execution or full memory disclosure.
RemediationAI
Upgrade affected devices to MikroTik RouterOS 7.24 or later; the vendor-released patch is the 7.24 stable build announced at https://forum.mikrotik.com/t/7-24-stable-is-released/272381, and additional detail is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/mikrotik-routeros-out-of-bounds-read-via-smb1-sessionsetupandx. Because SMB is not enabled by default and the vulnerability is only reachable through the SMB1 SessionSetupAndX handler, the most effective interim mitigation on systems that cannot be patched immediately is to disable the SMB service entirely (for example, disabling the SMB sharing service under /ip smb or the equivalent package/service toggle) - the trade-off is that all SMB/CIFS file sharing on the device stops working. If SMB must remain enabled, restrict access with firewall rules to trusted management subnets only and block inbound TCP 445 and 139 from untrusted networks; this reduces exposure but does not eliminate the over-read for allowed clients, and it can break legitimate file-sharing access from legitimate remote users. Restricting reachability to a segmented management VLAN is a reasonable compensating control where SMB sharing is required internally.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-125 out-of-bounds read in MikroTik's userspace SMB (Server Message Block) daemon. RouterOS implements an SMB1 server for file-sharing functionality, and the SessionSetupAndX command is the SMB1 negotiation step where a client presents a username and password blob during session establishment. The daemon parses the uniPwdLen (Unicode password length) field from the request to determine how many bytes of the password buffer to consume; by supplying an inconsistent or oversized uniPwdLen value in an otherwise minimal frame, an attacker can cause the handler to read past the end of the allocated request buffer. Because this parsing happens before any credential validation logic runs, the read is reachable without authentication. The primary effect is limited disclosure of adjacent heap memory contents (VC:L) and, secondarily, potential service instability if the over-read hits unmapped memory (VA:L). The CPE cpe:2.3:a:mikrotik:routeros:*:*:*:*:*:*:*:* applies to all RouterOS builds prior to 7.24 that ship the SMB daemon; the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N) is consistent with the independent CVSS 3.1 assessment in noting the high Attack Requirements prerequisite - namely that SMB is disabled by default and must be explicitly enabled - which is the principal factor capping the severity.
Know when Routeros gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable pre-auth OOB read (AV:N/PR:N) yielding bounded memory disclosure (C:L) and possible daemon crash (A:L); no integrity impact and SMB-enabled prerequisite not modeled in 3.1 AC.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers to read beyond the end of the request buffer by supplying a crafted uniPwdLen field value in a minimal SMB1 SessionSetupAndX frame. The out-of-bounds read occurs in the SessionSetupAndX handler before any credential validation, potentially exposing sensitive memory contents.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: k
SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-a
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remot
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stor
Exploit-DB