EUVD-2026-84569
GHSA-r8vv-pch2-7g9j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because the attacker must be on-path in an established BGP session; PR:N as no device credentials are needed; impact is availability-only (BGP crash), so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MP_REACH_NLRI UPDATE message with a prefix-length value below the minimum valid for a labelled-VPN NLRI, which passes validation while describing a route with a negative-length address portion. Attackers can repeatedly send a single BGP UPDATE packet carrying a VPNv4 or VPNv6 NLRI with an out-of-bounds prefix-length to indefinitely hold down the BGP plane, causing session termination without a NOTIFICATION and triggering a service malfunction on the device.
AnalysisAI
Denial of service in MikroTik RouterOS: an on-path attacker able to inject a BGP UPDATE into an established session can crash the device's BGP routing service with a single malformed MP_REACH_NLRI UPDATE whose labelled-VPN NLRI carries a prefix-length below the minimum valid value. Affected are RouterOS builds before 7.25beta4 that run the routing/BGP service with the labelled-VPN VPNv4 or VPNv6 address family enabled; the malformed route passes NLRI validation, describes an address portion of negative length, terminates the session without a NOTIFICATION, and can be resent to hold down the BGP plane indefinitely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target RouterOS device to be running the BGP routing service with the labelled-VPN (VPNv4 or VPNv6) address family enabled, and the attacker must be 'on-path' - i.e., able to inject a BGP UPDATE into an established session, which in practice means being a configured/compromised BGP peer or holding a MITM position on the peering link. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) frames this as a high-severity, unauthenticated, network-reachable availability flaw, and the impact profile is accurate: a single malformed BGP UPDATE indefinitely holds down the BGP plane, terminating sessions without a NOTIFICATION. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to MikroTik RouterOS 7.25beta4 or later - Vendor-released patch: 7.25beta4 - which corrects the labelled-VPN NLRI prefix-length validation; the release announcement is at https://forum.mikrotik.com/t/7-25beta-development-is-released/272788 and the advisory at https://www.vulncheck.com/advisories/mikrotik-routeros-improper-input-validation-dos-via-bgp-labelled-vpn-nlri. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MikroTik RouterOS devices running BGP and confirm which are on builds before 7.25beta4 with VPNv4 or VPNv6 enabled; restrict TCP/179 access to known peer addresses, enable BGP logging and alerting, and schedule an emergency change to apply the vendor-released patch 7.25beta4. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: k
SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-a
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remot
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stor
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today