{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/routeros-7.23.0---7.23.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4.3,"id":"CVE-2026-89020"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["RouterOS (\u003c 6.49.21)","RouterOS (7.23.0 - 7.23.3)"],"_cs_severities":["low"],"_cs_tags":["vulnerability","privilege-escalation","network-device","routeros"],"_cs_type":"advisory","_cs_vendors":["MikroTik"],"content_html":"\u003cp\u003eA stack-based buffer overflow vulnerability (CVE-2026-89020) exists in the 'mtget' binary of MikroTik RouterOS within the TFTP request (RRQ) builder. Authenticated, low-privileged users can exploit this by issuing a maliciously crafted '/tool fetch' command with an excessively long tftp:// URL path. This allows for the overwriting of registers and the modification of the system's group policy configuration file ('/rw/store/group.dat'). Consequently, accounts with read-only access can be promoted to full-privileged status, with the configuration changes persisting across device reboots.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAuthenticated user identifies an unpatched RouterOS instance.\u003c/li\u003e\n\u003cli\u003eUser initiates a loopback TFTP fetch command using '/tool fetch'.\u003c/li\u003e\n\u003cli\u003eUser provides a crafted, over-long (4094 B) tftp:// URL path as the source-path parameter.\u003c/li\u003e\n\u003cli\u003eThe mtget binary performs an unbounded memory copy, triggering a stack overflow.\u003c/li\u003e\n\u003cli\u003eThe overflow overwrites saved registers, allowing the attacker to redirect execution.\u003c/li\u003e\n\u003cli\u003eThe process modifies '/rw/store/group.dat', altering policy definitions to grant full privileges to the 'read' group.\u003c/li\u003e\n\u003cli\u003eThe device reboot process loads the corrupted group file, establishing persistent administrative access for the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative control over the affected network appliance. The change to the group policy file is persistent and survives device reboots, potentially leading to long-term unauthorized access and control of the network infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade RouterOS to version 6.49.21 or later, or 7.23.4 or later, to receive the fix for CVE-2026-89020.\u003c/li\u003e\n\u003cli\u003eAudit existing RouterOS instances for unauthorized modifications to group policies using 'group print detail'.\u003c/li\u003e\n\u003cli\u003eRestrict access to the '/tool fetch' command and TFTP functionality to authorized administrative users only.\u003c/li\u003e\n\u003cli\u003eImplement network-level segmentation to prevent low-privileged users from reaching sensitive device management interfaces.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T23:04:32Z","date_published":"2026-10-30T23:04:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mikrotik-routeros-mtget-overflow/","summary":"An authenticated, low-privileged user can trigger a stack-based buffer overflow in the RouterOS mtget binary via a crafted TFTP fetch request to gain persistent administrative privileges.","title":"MikroTik RouterOS: Persistent Privilege Escalation via mtget Stack Overflow (CVE-2026-89020)","url":"https://feed.craftedsignal.io/briefs/2026-10-mikrotik-routeros-mtget-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - RouterOS (7.23.0 - 7.23.3)","version":"https://jsonfeed.org/version/1.1"}