{"cve_id":"CVE-2026-67277","published":"2026-09-05T20:17:18.120000+00:00","last_modified":"2026-09-11T12:52:29.533000+00:00","vuln_status":"Analyzed","description":"RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.\n\n\n\nThis issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","base_score":8.2,"base_severity":"HIGH","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"LOW","impact_i":"NONE","impact_a":"HIGH","cwe_ids":["CWE-306"],"in_kev":true,"kev_date_added":"2026-09-10","kev_ransomware":false,"epss_score":0.0156,"epss_percentile":0.75236,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"USER","caps":["AUTH_BYPASS","INFO_DISCLOSURE"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-10-07T07:11:48.076660+00:00","first_seen":"2026-09-05T20:17:18.120000+00:00","kev_first_seen":"2026-09-10T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":"2026-09-23T03:23:42.520291+00:00","vendors":["mikrotik"],"products":["routeros"],"affected":[{"vendor":"mikrotik","product":"routeros","ranges":["≥ 6.0 and < 6.49.21","≥ 7.0 and < 7.23.4","≥ 7.24 and < 7.24.2"]}]}