EUVD-2026-80702
GHSA-2jvh-jvq5-35jq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote request to the SMB daemon (AV:N/PR:N/UI:N); crafted length deterministically triggers the underflow (AC:L); confirmed impact is a crash, so A:H with C:N/I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a uniPwdLen field that triggers an integer underflow, causing the resulting value to be used as the copy length in a memory copy operation into a smaller heap buffer, corrupting adjacent heap memory.
AnalysisAI
Heap memory corruption in the userspace SMB daemon of MikroTik RouterOS before 7.24 lets remote, unauthenticated attackers crash or destabilize the service by sending a crafted SMB1 SessionSetupAndX request whose uniPwdLen field triggers an integer underflow and an oversized copy into a smaller heap buffer (CWE-122). The independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as an availability-only impact - adjacent heap corruption in a userspace daemon, not a confirmed path to code execution - and the primary limiting factor is that the SMB service is not enabled by default on RouterOS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the RouterOS SMB service (IP > SMB) to be enabled and network-reachable, with SMB1/legacy dialect handling active, so the SessionSetupAndX code path can be reached - SMB is not enabled by default on RouterOS, which is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine unauthenticated network-reachable memory-corruption bug (CVSS 4.0 8.2, AV:N/AC:L/PR:N/UI:N) in RouterOS's userspace SMB daemon, reported by VulnCheck with a vendor patch already shipped in RouterOS 7.24. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade RouterOS to 7.24 or later via the standard package update path (/system package update install or manual package upload), and verify the installed version after reboot; the fix is documented in MikroTik's 7.24 stable release thread at https://forum.mikrotik.com/t/7-24-stable-is-released/272381, with technical detail in the VulnCheck advisory at https://www.vulncheck.com/advisories/mikrotik-routeros-heap-corruption-via-smb1-sessionsetupandx. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MikroTik RouterOS devices and determine which have the SMB service enabled and reachable from untrusted networks; where SMB is not required for business operations, disable it immediately and block TCP/445 and TCP/139 at the perimeter, and where it is required, apply the vendor-released patch to RouterOS 7.24 without delay, prioritizing internet-facing or partner-reachable devices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: k
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remot
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stor
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consu
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today