CVE-2026-67277: Unauthenticated Kernel Memory Leak and DoS in MikroTik RouterOS btest

Exposing bandwidth testing utilities to the open internet has long been a common misconfiguration on edge network equipment, but a flaw in MikroTik RouterOS makes it significantly more dangerous. Identified as CVE-2026-67277, this missing authentication vulnerability allows remote, unauthenticated attackers to trigger kernel memory disclosure and cause a denial of service through the RouterOS btest service.

Flaw Overview: Unauthenticated Access to RouterOS btest

The Bandwidth Test server (btest) in RouterOS operates over TCP and UDP port 2000 to measure network throughput between RouterOS devices or administrator workstations. Under CVE-2026-67277 (categorized under CWE-306 for missing authentication on critical functions), the service fails to validate user authorization prior to processing specific low-level request handling routines.

An attacker who can reach the listening btest port can transmit crafted packets that interact directly with the kernel-level routines handling the test server. This exposes two primary exploit vectors: reading uninitialized or active kernel memory, and triggering kernel panics that cause immediate device reboots.

Attack Path and Operational Risk

Although the standard EPSS probability sits at 0.43% (putting it in the 36.7th percentile of tracked vulnerabilities), the actual operational risk depends heavily on interface exposure. MikroTik devices are widely deployed as edge routers, branch gateways, and Wireless Internet Service Provider (WISP) infrastructure. In many environments, btest is left enabled by default or left exposed to untrusted WAN interfaces for diagnostic convenience.

The realistic attack path involves two scenarios:

1. Memory Information Disclosure: Extracted kernel memory can contain pointer addresses, internal data structures, or sensitive transit data. In advanced exploit chains, leaking kernel memory offsets is a prerequisite for bypassing Kernel Address Space Layout Randomization (KASLR) to achieve full system compromise.
2. Infrastructure Disruption: Sending memory-corrupting requests directly crashes the operating system kernel. On an edge router or core routing gateway, this results in immediate drops of active sessions, VPN tunnels, and downstream network traffic.

Mitigation and Hardening

Administrators managing MikroTik RouterOS devices should immediately check whether the bandwidth test server is active and exposed to untrusted networks.

1. Disable the Bandwidth Server: If the tool is not actively being used for network diagnostics, turn off the server component via the command line:

   /tool bandwidth-server set enabled=no

2. Restrict WAN Access: If btest is required, restrict access to trusted management IP subnets using input firewall rules on port 2000 (TCP/UDP):

   /ip firewall filter add chain=input protocol=tcp dst-port=2000 src-address-list=Management_Subnets action=accept
   /ip firewall filter add chain=input protocol=udp dst-port=2000 src-address-list=Management_Subnets action=accept
   /ip firewall filter add chain=input protocol=tcp dst-port=2000 action=drop
   /ip firewall filter add chain=input protocol=udp dst-port=2000 action=drop

3. Software Updates: Upgrade RouterOS to the latest long-term or stable release provided by MikroTik. Ensure federal networks and governed assets align remediation timelines with BOD 26-04 risk guidelines.