CVE-2026-67277: Authentication Bypass and Integer Underflow in MikroTik RouterOS Bandwidth-Test Service (Kernel Memory Leak & DoS)

HERMES

HERMES THREAT SCORE & SERVICE AVAILABILITY / CONFIDENTIALITY RISK

Target: MikroTik RouterOS - Bandwidth Test (btest) Service (TCP/UDP Port 2000)

Confidence: 98%

88 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 17 / 20

Weaponization 18 / 20

Exposure 19 / 20

Prevalence 18 / 20

Impact 17 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 16 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-67277 at 8.8 (High) and CVSS v4.0 at 8.7 (High). The Hermes Threat Score assigns it 88 (HIGH). The vulnerability impacts the proprietary bandwidth measurement service (btest on port 2000), frequently left open to the internet by network engineers to test link saturation. An unauthenticated remote attacker can force an immediate Linux kernel panic causing endless reboot loops (Denial of Service), or compel the daemon to transmit raw uninitialized kernel packet memory, exposing cryptographic keys, authentication tokens, and transient cross-client network packets.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-67277: MikroTik RouterOS Bandwidth-Test Auth Bypass & Kernel Memory Leak / DoSVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTMikroTik RouterOS

99% VERY_HIGH

Network operating system developed by MikroTik providing routing, firewall, VPN, and bandwidth-testing services on edge and core network devices.

🔍 Why is this related? (Evidence & Provenance)

“Missing authentication and integer underflow in bandwidth-test (btest) service on RouterOS.”

Supporting Verified Evidence:

• [cert_confirmation]CISA and MikroTik confirmed CVE-2026-67277 enables remote kernel memory disclosure and DoS via btest service. — Source: CISA / MikroTik Security: CISA KEV & MikroTik Advisory: RouterOS Bandwidth-Test Vulnerability (CVE-2026-67277) (Reliability: VERY_HIGH)

→ affectsPRODUCTFortinet FortiOS Gateway

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Fortinet FortiOS Gateway documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CISA KEV Alert: Active In-the-Wild Exploitation (BOD 26-04 Directive)

CVSS v3.1: 8.8 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) / CVSS v4.0: 8.7 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N) / CWE-306: Missing Authentication for Critical Function, CWE-191: Integer Underflow, CWE-200: Exposure of Sensitive Information. Added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on September 10, 2026 under BOD 26-04. Affects MikroTik RouterOS v6 Long-term < 6.49.21, v7 Long-term < 7.23.4, and v7 Stable < 7.24.2. Fixed in 6.49.21, 7.23.4, 7.24.2, and 7.25beta3.

Executive Summary

On September 3, 2026, MikroTik released security updates addressing CVE-2026-67277, a high-severity flaw within the Bandwidth-Test (btest) service. Operating on standard TCP/UDP port 2000, this diagnostic utility enables throughput measurements between RouterOS nodes.

The vulnerability stems from an authentication check bypass on “related” test data streams before control-session authentication completes. By dispatching crafted UDP packets configured with random-data=false and inverted packet size bounds, an unauthenticated remote attacker triggers an unsigned 32-bit integer underflow in the RouterOS kernel driver. This either induces the transmission of uninitialized kernel memory packets (leaking sensitive encryption keys and transit data) or provokes an immediate kernel panic resulting in device reboot.

---

1. Technical Context & Affected Software Matrix

The bandwidth-server tool is widely deployed across enterprise perimeter routers, WISP relays, and data centers.

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-67277	International tracking ID & CISA KEV listing
Vendor / Platform	MikroTik / RouterOS	Operating system on RouterBOARD & x86 architectures
Vulnerable Service	bandwidth-server (btest)	TCP/UDP throughput test utility
Network Layer	Port 2000/TCP and 2000/UDP	Default listening service
Core Impact	Kernel Memory Leak (CWE-200) & System DoS (CWE-400)	Forced reboot or kernel RAM data extraction
Affected Versions (v6)	Branch Long-term v6 < 6.49.21	Legacy infrastructure routers
Affected Versions (v7)	Branch Long-term v7 < 7.23.4; Branch Stable < 7.24.2	Current enterprise production deployments
Patched Versions	6.49.21 (v6), 7.23.4 (v7), 7.24.2 (v7), 7.25beta3	Official vendor patches from September 3, 2026
CISA KEV Status	Added on September 10, 2026 (BOD 26-04)	Actively leveraged in the wild

---

2. In-Depth Technical Decomposition: Anatomy of the btest Flaw

MikroTik’s proprietary bandwidth-test protocol relies on two channels:

1. A control session on port 2000 (authentication and test parameters: protocol, packet sizes, duration, random data toggle).
2. A related data stream that pumps UDP/TCP datagrams to evaluate link capacity.

+---------------------------------------------------------------------------------------------------------+
|                               MECHANICS OF THE BTEST EXPLOITATION (CVE-2026-67277)                      |
+---------------------------------------------------------------------------------------------------------+

  [Attacker Machine]                                                    [Target MikroTik RouterOS]
   IP: 198.51.100.42                                                     IP: 203.0.113.1
                                                                         Port UDP 2000 (btest enabled)
          │                                                                      │
   [1]    │───── UDP btest packet marked as "related" stream ────────────────────>│ CWE-306 Flaw:
          │      (No authentication completed on primary control session)        │ Accepts related test data
          │                                                                      │ without verifying parent auth!
          │                                                                      │
   [2]    │───── Inverted Packet Range Payload: ─────────────────────────────────>│
          │      - random-data = false                                           │
          │      - min_packet_size = 1500                                        │
          │      - max_packet_size = 64 (Inverted bounds!)                       │
          │                                                                      │
   [3]    │                                                                      │ Kernel Buffer Calculation:
          │                                                                      │ delta = (max_packet_size - min_packet_size)
          │                                                                      │ delta = (64 - 1500) = -1436
          │                                                                      │ Unsigned uint32 Underflow (CWE-191):
          │                                                                      │ delta = 0xFFFFFA64 (4,294,965,860 bytes)!
          │                                                                      │
   [4]    │                                                                      │ Path A: Kernel Memory Leak (CWE-200)
          │<════ Receives packets packed with raw uninitialized RAM fragments ═══│ Sends uninitialized kernel buffers
          │                                                                      │ (session keys, tokens, transit data)
          │                                                                      │
          │                                                                      │ Path B: Kernel Panic DoS (CWE-400)
          │                                                                      │ Out-of-bounds page fault triggered
          │                                                                      │ [KERNEL PANIC] & Forced Device Reboot!

1. Missing Authentication for Related Data Channels (CWE-306)

When UDP datagrams tagged as an active “related” test stream arrive on port 2000, RouterOS initializes internal connection structures and begins processing without confirming that the control session completed authentication.

2. Unsigned Integer Underflow (CWE-191) & Memory Disclosure (CWE-200)

When random-data=false is selected, the buffer allocation logic calculates packet sizing by subtracting minimum size from maximum size:

• If an adversary submits min_packet_size = 1500 and max_packet_size = 64, the kernel driver performs 64 - 1500.
• In 32-bit unsigned arithmetic (uint32_t), this wraps around to 4,294,965,860.
• Depending on architecture memory limits and buffer layout:
  1. Kernel Memory Disclosure: The system attempts to transmit oversized frame chunks without zeroing memory, streaming uninitialized kernel memory fragments to the attacker.
  2. Denial of Service (Kernel Panic): The copy loop touches unmapped physical memory pages, triggering a kernel page fault that immediately panics the Linux kernel and reboots the router.

---

3. Threat Intelligence, Threat Actors & Active Exploitation

CISA KEV Listing on September 10, 2026

Under Binding Operational Directive (BOD) 26-04, CISA mandated that all federal civilian executive branch agencies remediate CVE-2026-67277 by October 1, 2026.

Real-World Attack Patterns

1. Zero-Cost Asymmetric Denial of Service:
   • Traditional DDoS requires massive botnet bandwidth. In contrast, a single crafted UDP packet sent to port 2000 immediately reboots an enterprise boundary router.
   • Attackers automate scripts sending a single packet every 90 seconds, inducing a permanent reboot loop with near-zero network footprint.
2. Reconnaissance & Memory Harvesting:
   • Espionage actors leverage the information leak to recover session keys and plaintext data from packet buffers prior to IPsec/WireGuard encryption.

---

4. Doctrinal Principle: “What happens if this vulnerability is exploited in an enterprise?“

1. Perimeter Communications Blackout

The enterprise’s primary internet and WAN connections drop instantly:

• All outbound cloud access and SaaS tools (Salesforce, Microsoft 365, AWS) fail.
• Site-to-site IPsec and WireGuard tunnels between corporate branches collapse.
• Corporate SIP/VoIP communications and remote worker VPNs are severed.

2. BGP Route Flapping & Carrier Penalties

For organizations managing their own Autonomous System (ASN):

• Repeated router crashes trigger BGP session flapping with upstream Tier-1 ISPs.
• Upstream transit providers apply Route Flap Damping, suppressing the enterprise’s IP prefixes for several hours even after the attack ceases.

3. Exposure of In-Flight Cryptographic Secrets

Attackers extracting uninitialized kernel packet buffers may recover sensitive credentials, API tokens, or pre-shared keys traversing the device.

---

5. Threat Hunting, Detection & Forensic Investigation

Identifying Exploit Symptoms in RouterOS

A device subjected to CVE-2026-67277 crashes exhibits characteristic watchdog reboot logs:

Execute the following commands in the RouterOS CLI:

# 1. Verify bandwidth-server operational state
/tool bandwidth-server print

# 2. Inspect system reboot triggers
/log print where topics~"system" or topics~"critical"

# 3. Check for crash dump files
/file print where name~"autosupout" or name~"crash"

If logs show: system,critical router was rebooted without proper shutdown by watchdog or kernel failure, correlated with prior UDP 2000 traffic, the device was targeted.

---

Sigma Rule: MikroTik RouterOS btest Service Exploitation Crash

title: MikroTik RouterOS Kernel Crash via btest Exploitation (CVE-2026-67277)
id: 67277-mikrotik-btest-crash
status: experimental
description: Detects unexpected router reboots caused by watchdog kernel panics correlated with exposed Bandwidth-Test service activity.
author: Hermes Codex CTI
date: 2026-09-11
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67277
tags:
  - attack.impact
  - attack.t1499
  - attack.t1190
logsource:
  product: routeros
  service: system_log
detection:
  selection_crash:
    topics|contains: 'critical'
    message|contains:
      - 'rebooted without proper shutdown'
      - 'kernel failure'
      - 'watchdog'
  selection_btest_audit:
    topics|contains: 'btest'
  condition: selection_crash or selection_btest_audit
falsepositives:
  - Physical power loss events
level: high

---

Suricata / Snort Rule: btest Integer Underflow Probe

# Detects inverted packet range probe targeting MikroTik btest on port 2000/UDP (CVE-2026-67277)
alert udp any any -> any 2000 (msg:"HERMES CODEX - MikroTik RouterOS btest Integer Underflow Denial of Service Probe (CVE-2026-67277)"; flow:to_server; content:"|01 00 00|"; depth:3; reference:cve,2026-67277; reference:url,cisa.gov/known-exploited-vulnerabilities-catalog; classtype:denial-of-service; sid:202667277; rev:1;)

---

6. MITRE ATT&CK Mapping

Tactical Phase	MITRE ID	Technique / Sub-technique	Role in Attack
Initial Access	T1190	Exploit Public-Facing Application	Targeting btest daemon on TCP/UDP port 2000
Discovery	T1040	Network Sniffing / Memory Disclosure	Extracting uninitialized kernel memory remnants
Impact	T1499.004	Endpoint Denial of Service: Application or System Exploitation	Triggering kernel panic and continuous device reboot loops
Impact	T1498	Network Denial of Service	Disrupting all enterprise edge transit traffic

---

7. Comprehensive Remediation & Hardening Guide

1. Apply Official Firmware Updates

Upgrade RouterOS to one of the patched releases:

• v6 Long-term Branch: Version 6.49.21 (or later)
• v7 Long-term Branch: Version 7.23.4 (or later)
• v7 Stable Branch: Version 7.24.2 (or later)
• v7 Testing Branch: Version 7.25beta3 (or later)

/system package update set channel=stable
/system package update check-for-updates
/system package update download
/system reboot

[!IMPORTANT] Reboot Required: YES. Firmware updates require a device restart (/system reboot) to apply kernel fixes.

2. Immediate Workaround: Disable Bandwidth-Server

In production networks, the bandwidth-test server should never remain enabled by default:

# Disable the Bandwidth-Test server immediately
/tool bandwidth-server set enabled=no

Verify that enabled reports no:

/tool bandwidth-server print

3. Perimeter Firewall Drop Rules

If internal testing requires the service, strictly block port 2000 on WAN interfaces:

# Drop port 2000 TCP and UDP from the internet
/ip firewall filter add chain=input protocol=tcp dst-port=2000 in-interface-list=WAN action=drop comment="BLOCK-BTEST-WAN-CVE-2026-67277"
/ip firewall filter add chain=input protocol=udp dst-port=2000 in-interface-list=WAN action=drop comment="BLOCK-BTEST-WAN-CVE-2026-67277"

---

8. Related Threat Intelligence & References

CVE-2026-86060: MikroTik RouterOS Administrative Privilege Escalation (MikroTrick) Anatomy of SSH argument delimiter injection delivering full administrator takeover on RouterOS edge devices.

CVE-2025-25249: Fortinet FortiOS cw_acd CAPWAP Heap Overflow RCE Heap buffer overflow on UDP port 5246 exploited in the wild with PivotC2 implants.

CVE-2026-20079: Cisco Secure FMC Authentication Bypass to Root RCE Analysis of perimeter management plane authentication bypass and root command injection.

Incident Response: EDR Alert Triage Playbook Systematic procedures for triaging edge perimeter alerts, anomalies, and network probing.