We have verified that an unauthenticated client can exploit the btest service to extract uninitialized data from kernel memory. The issue is resolved by updating RouterOS to versions 6.49.21, 7.23.4, or 7.24.2.
We tested the vulnerability CVE-2026-67277, a lack of authentication for a critical function (CWE-306) in the btest service of RouterOS. The proof demonstrates how an attacker can receive sensitive data from kernel memory and cause a system reboot via an integer underflow bug.
The test environment consisted of a CHR running RouterOS 7.23.3, a version known to be vulnerable. The btest service was enabled by default on TCP/UDP port 2000. The topology involved a direct connection to the IP address 10.99.0.2 of the virtual machine.
Reserved for members
This content is reserved for those in the dojo.
Entry is free: you subscribe to the newsletter with your email and then choose to join the dojo, without a password. How it works
