MikroTik RouterOS: Persistent Privilege Escalation via mtget Stack Overflow (CVE-2026-89020)

A stack-based buffer overflow vulnerability (CVE-2026-89020) exists in the 'mtget' binary of MikroTik RouterOS within the TFTP request (RRQ) builder. Authenticated, low-privileged users can exploit this by issuing a maliciously crafted '/tool fetch' command with an excessively long tftp:// URL path. This allows for the overwriting of registers and the modification of the system's group policy configuration file ('/rw/store/group.dat'). Consequently, accounts with read-only access can be promoted to full-privileged status, with the configuration changes persisting across device reboots.

Attack Chain

1. Authenticated user identifies an unpatched RouterOS instance.
2. User initiates a loopback TFTP fetch command using '/tool fetch'.
3. User provides a crafted, over-long (4094 B) tftp:// URL path as the source-path parameter.
4. The mtget binary performs an unbounded memory copy, triggering a stack overflow.
5. The overflow overwrites saved registers, allowing the attacker to redirect execution.
6. The process modifies '/rw/store/group.dat', altering policy definitions to grant full privileges to the 'read' group.
7. The device reboot process loads the corrupted group file, establishing persistent administrative access for the attacker.

Impact

Successful exploitation results in full administrative control over the affected network appliance. The change to the group policy file is persistent and survives device reboots, potentially leading to long-term unauthorized access and control of the network infrastructure.

Recommendation

• Upgrade RouterOS to version 6.49.21 or later, or 7.23.4 or later, to receive the fix for CVE-2026-89020.
• Audit existing RouterOS instances for unauthorized modifications to group policies using 'group print detail'.
• Restrict access to the '/tool fetch' command and TFTP functionality to authorized administrative users only.
• Implement network-level segmentation to prevent low-privileged users from reaching sensitive device management interfaces.