CVE-2026-67277
High · 8.2 CISA KEVCVSS
8.2
EPSS
1.6%
Published
Sep 5, 2026
CISA due date
Sep 13, 2026
The record
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes… CWE-306
- CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-306
- CVE-2026-53714 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-306
- CVE-2026-89261 MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search… CWE-306
- CVE-2026-89250 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an… CWE-306
- CVE-2026-89176 WeenyGenius, a computer lab management system developed by Howyar Technologies, has a… CWE-306
- CVE-2026-88285 GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without… CWE-306
- CVE-2026-87924 A security vulnerability has been detected in Rizwan17 inventory-management-system up to… CWE-306