CVE-2026-89028

MikroTik RouterOS versions before 7.24 ship a userspace SMB server whose SMB1 SessionSetupAndX handler fails to validate the uniPwdLen field: a crafted value triggers an integer underflow (CWE-191) and the resulting length is used to copy data into a smaller heap buffer, corrupting adjacent heap memory (CWE-122). Any unauthenticated remote attacker who can reach the SMB service can trigger the flaw with a single malformed SMB1 request, with no credentials or user interaction required. The scored impact is high availability loss — the heap corruption can crash the SMB daemon/service — while confidentiality and integrity impacts were not demonstrated; heap corruption can in principle enable deeper exploitation, but no such exploit is documented. All RouterOS deployments older than 7.24 carry the flaw, but only devices with the SMB server enabled and network-reachable are exploitable in practice (the CVSS 'high attack requirements' metric reflects that the service is not enabled in default configurations). The vulnerability is not in CISA's KEV catalog, no public proof-of-concept is known, and no exploitation has been reported to date.

What to do: Upgrade all RouterOS devices to version 7.24 or later. Where immediate upgrade is not possible, disable the SMB server (/ip smb set enabled=no) and ensure TCP 445 is filtered on WAN-facing interfaces, since exploitation requires network reachability to the SMB service. Audit deployments for enabled SMB and internet-exposed port 445, and watch for SMB daemon crashes as a potential indicator of targeting.