iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
RouterOS versions 7.24–before 7.24.2, 7.0.0–before 7.23.4, and 6.0.0–before 6.49.21 are affected by CVE-2026-67277. Upgrade to the corresponding fixed release or a later supported release, restrict the bandwidth-test service and other router services to trusted networks, then check logs and configuration for signs of compromise. The flaw can be triggered before authentication completes and may disclose a small amount of kernel memory or restart the router.
What CVE-2026-67277 does
CVE-2026-67277 affects RouterOS bandwidth testing. CERT Polska describes a flaw in which a related bandwidth-test (btest) connection can be accepted before authentication of its corresponding primary session has completed. That timing can let an unauthenticated client start an IPv4 UDP test.
In CERT Polska’s technical account, when random-data=false, the sender can transmit an uninitialized tail from a kernel packet buffer. The flaw also involves an unchecked, inverted packet-size interval that can cause unsigned integer underflow and anomalously large fragmented output, potentially restarting the RouterOS kernel. MikroTik’s summary describes the possible outcomes as a router crash or disclosure of a small amount of memory.
This is the bandwidth-test issue, not the separate SSH remote-command issue tracked as CVE-2026-67279. The September 2026 disclosure covers multiple RouterOS vulnerabilities, and reports of exploitation involving related SSH flaws should not be treated as evidence that attackers exploited this bandwidth-test flaw specifically.
#1 Best Overall
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
Which RouterOS versions are affected?
CERT Polska identifies these affected ranges and fixes for CVE-2026-67277. Install the fix for the device’s branch or a later supported release.
| Affected RouterOS range | Fixed release |
|---|---|
| 7.24 up to, but not including, 7.24.2 | 7.24.2 |
| 7.0.0 up to, but not including, 7.23.4 | 7.23.4 |
| 6.0.0 up to, but not including, 6.49.21 | 6.49.21 |
Inventory devices across your supported RouterOS channels before scheduling updates. Select a release appropriate to each device and your organization’s change-control requirements, then verify the installed version after upgrading. The fixed versions above address this CVE; they should not be confused with later fixes for CVE-2026-67278, a separate certificate and SSH host-key issue for which MikroTik later identified 7.24.3 and 7.23.6 as complete fixes.
Rank #2
- Wired Gigabit Router – 5x Gigabit Ethernet ports, 2.5G SFP, PoE-Out, USB, powered by RouterOS
Can it be exploited without logging in?
Yes. The vulnerability concerns acceptance of a related bandwidth-test connection before authentication of the primary session has completed, enabling an unauthenticated client to start the described IPv4 UDP test. Actual exposure depends on whether the service is reachable from an attacker’s network.
Check each router’s real network reachability rather than assuming that a vendor statement about another service applies. MikroTik says its default firewall blocks internet access to the web interface; that statement is not proof that bandwidth-test is blocked on every installation. Restrict router services to trusted source addresses, disable services that are not needed, and use a VPN for remote administration where appropriate.
Rank #3
Detection and response steps
- Inventory and prioritize: Identify RouterOS versions and update channels on managed devices. Prioritize affected devices, especially those reachable from untrusted networks.
- Reduce exposure: Review firewall and service configuration on each device. Limit management and other router services to trusted source addresses, disable unneeded services, and assess bandwidth-test reachability directly.
- Patch and verify: Upgrade to the matching fixed release or a later supported release. Confirm that the router is running the intended version after the update.
- Check the device’s status: Review the RouterOS log for a critical entry stating that the device has been Flagged. MikroTik says RouterOS checks for signs of compromise and can mark a device Flagged; this status check is not a guarantee that every compromise will be detected.
- Inspect for unexpected changes: Review users, scripts, and configuration for entries you do not recognize. Monitor authentication logs and network activity for unauthorized access.
- Escalate suspicious findings: Preserve relevant logs and configuration data. Follow your organization’s incident-response process before returning a router with suspicious changes to normal operation.
These are operational review steps, not a CVE-specific detection signature. The cited advisories do not provide a validated CVE-2026-67277 detection rule or specific indicators of compromise.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is known about exploitation?
The wider RouterOS disclosure carries meaningful risk, but attribution matters. DIVD reports that the Netherlands NCSC said CERT Polska observed active exploitation against MikroTik routers with publicly accessible SSH, combining multiple vulnerabilities to gain full control. That report does not establish that CVE-2026-67277 was the vulnerability used in those intrusions.
Rank #4
- MikroTik RouterBOARD C52iG-5HaxD2HaxD-TC-US (US Version) hAP ax (WiFi6) Quad-Core IPQ-6010 864 MHz, RAM 1GB, RouterOS, License level 4 It's time to supercharge your home network with the Generation
- hAP ax has everything you might need in a primary home access point - and more
- Forget endless reviews and comparisons - this is the perfect device for 99% of homes
- Wireless signal is now stronger than ever
- Here are the two main ingredients of hAP ax's success: a state-of-the-art dual-band, dual-chain 4-4
The Canadian Centre for Cyber Security reported that CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities database on September 10, 2026. This is a relevant warning about the overall risk context, but the reviewed reporting does not attribute observed attacks specifically to the bandwidth-test flaw. No affected-device count or CVE-specific incident total is established in these sources.
Quick Recap
Best Value
- W128339515
How the disclosure developed
- September 3, 2026: MikroTik published its RouterOS vulnerability notice.
- September 5, 2026: CERT Polska published its vulnerability records and attributed discovery to researcher Sławomir Rozbicki, who participated in coordinated disclosure.
- September 10, 2026: The Canadian Centre for Cyber Security issued alert AL26-020 and reported the KEV additions.
- October 6, 2026: MikroTik updated its advisory to identify six CVEs and clarify the complete fix for the separate CVE-2026-67278 issue.
Sources
- CERT Polska: Vulnerabilities in Mikrotik RouterOS software
- MikroTik: September 2026 vulnerability advisory
- DIVD CSIRT: DIVD-2026-00012
- Canadian Centre for Cyber Security: Alert AL26-020
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
