RouterOS (< 7.25beta4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/routeros--7.25beta4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 22 Sep 2026 18:39:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-93345: Improper Input Validation in MikroTik RouterOS BGP Servicehttps://feed.craftedsignal.io/briefs/2026-09-mikrotik-bgp-dos/Tue, 22 Sep 2026 18:39:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-mikrotik-bgp-dos/An unauthenticated, on-path attacker can trigger a denial-of-service condition in MikroTik RouterOS by sending malformed BGP UPDATE packets with out-of-bounds prefix-lengths.MikroTik RouterOS versions prior to 7.25beta4 contain an improper input validation vulnerability within the labelled-VPN NLRI iterators of the BGP routing service. This flaw allows an unauthenticated, on-path attacker to send a malformed MP_REACH_NLRI UPDATE message containing a prefix-length value that is below the minimum required for a valid labelled-VPN NLRI. Because the router fails to properly validate this value, it interprets the packet as describing a route with a negative-length address portion, leading to a service crash. Attackers can leverage this by repeatedly sending a single BGP UPDATE packet containing a VPNv4 or VPNv6 NLRI with an out-of-bounds prefix-length to cause indefinite BGP plane instability and repeated session terminations, effectively creating a persistent denial-of-service (DoS) condition on the affected device.

Impact

Successful exploitation results in a persistent denial-of-service condition, rendering the BGP service on the targeted MikroTik device unstable or non-functional. This impacts network routing availability for any traffic relying on the BGP session handled by the vulnerable process.

Recommendation

Prioritize the identification of internet-facing or peer-connected MikroTik devices. Upgrade all affected instances of RouterOS to version 7.25beta4 or later to address the input validation flaw identified in CVE-2026-93345.

]]>lowadvisory