RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

RouterOS accepts a related btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With random- data=false, the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 6.x prior to 6.49.21, or 7.0.x prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by multiple vulnerabilities :

  - RouterOS accepts a 'related' btest connection before the corresponding primary session has     completed authentication. An unauthenticated client can use this state to start an IPv4 UDP     test. With 'random-data=false', the sender transmits an uninitialized tail from a kernel packet     buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow,     anomalously large fragmented output, and can restart the RouterOS kernel. (CVE-2026-67277)

  - RouterOS contains an argument-handling flaw in the SSH login path involving usernames that     begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed,     leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach     the RouterOS login helper. (CVE-2026-86060)

  - RouterOS SSH enters the connection protocol after a client-requested rekey even though user     authentication was never attempted, allowing an unauthenticated client to open a session     channel and send an exec request. On affected builds the server dispatches the command,     enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS     managed file namespace, including support files containing configuration and diagnostic data.
    (CVE-2026-67279)

Note that Nessus has not tested for this issue but has instead relied only on the router's self-reported version number.

ID	Name	Product	Family	Type	Severity
506059	MikroTik RouterOS Missing Authentication for Critical Function (CVE-2026-67277)	Tenable OT Security	Tenable.ot	Remote	high
344588	MikroTik RouterOS 6.x < 6.49.21 / 7.0.x < 7.23.4 / 7.24.x < 7.24.2 Multiple Vulnerabilities	Nessus	Misc.	Remote	critical

Detections

Analytics

CVE-2026-67277

high

Tenable Plugins

high

critical