CVE-2026-89020 MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path Leading to Privilege Escalation

Description

MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership. On older RouterOS versions, this overflow is not limited to crashing the process: the deterministic overwrite of saved registers is exploitable to achieve persistent privilege escalation on the device. On versions with intact exploit mitigations, the impact is limited to a crash of the mtget worker process.

Exploitable remotely over the network, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

Low

Interaction

None

Confidentiality

High

Integrity

High

Availability

High

Confidentiality of other systems

None

Integrity of other systems

None

Availability of other systems

None

Affected products and versions