RouterOS btest kernel crash, exploited (CVE-2026-67277)

Actively exploited in the wild - CVE-2026-67277 is a high-severity kernel memory disclosure and denial-of-service flaw in MikroTik RouterOS btest (bandwidth test) server on Long-term 6.49.x, 7.23.x, and Stable 7.24.x that lets an unauthenticated network client read uninitialized kernel buffer contents and restart the device. Fixed in 6.49.21, 7.23.4, and 7.24.2 - upgrade immediately.

Overview

RouterOS runs the btest server on TCP port 2000 to measure throughput between MikroTik devices. The listener accepts a “related” btest connection before the primary session has finished authenticating, so an attacker can arrive with no credentials at all and still drive a test. With the session option random-data=false, the sender transmits the tail of a kernel packet buffer that was never initialized, handing the client whatever residual memory sat there. A second defect, an unchecked and inverted packet-size interval, causes unsigned integer underflow. The resulting size value is astronomically large, producing fragmented output far beyond any legitimate test, and in the observed cases it restarts the RouterOS kernel outright.

Impact

Two distinct consequences land together. The information disclosure leaks uninitialized kernel memory to the remote client, which may carry fragments of prior packet payloads, session data, or other kernel-resident content. The denial of service is immediate and repeats: each crafted connection can force a reboot, taking routing, NAT, VPN, firewall, and hotspot services offline for every user behind the device. Because no authentication is required and the attack is a single network connection, any internet-reachable RouterOS device with btest exposed is a target. The CVSS score of 8.8 reflects the combination of unauthenticated network access, low complexity, and full availability loss. CISA added this CVE to the Known Exploited Vulnerabilities catalog, so exploitation has been observed, not just theorized. The EPSS score remains low at roughly 0.4 percent, indicating broad scanning has not yet scaled, but targeted abuse of exposed btest listeners is confirmed.

Remediation and Mitigation

Upgrade to a fixed release: 6.49.21 on Long-term for the 6.x branch, or 7.23.4 (Long-term) and 7.24.2 (Stable) for 7.x. If immediate upgrade is not possible, block TCP port 2000 at the network edge and disable the btest server under Tools > BTest Server. Restrict management and testing ports to trusted internal addresses only, and review logs for unexpected btest connections or unexplained reboots, which are the clearest sign of prior exploitation attempts. Organizations tracking incident fallout can consult breach reports and ongoing security news.

Security Insight

MikroTik’s btest has now produced a second class of pre-authentication bug, and the pattern is familiar: a convenience protocol designed for trusted LAN use, later exposed to the internet by default configurations that outlived the assumption. The uninitialized buffer here is the same failure mode that produced kernel memory disclosures in older wireless and tunnel drivers, and it persists because state machines accept traffic before identity is established. The lesson for network teams is that reachability on TCP 2000 should be treated with the same caution as SSH or Winbox, and that “trusted” protocols are only trusted until someone scans the port.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs