Description

MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T19:17:54.563Z",
  "pubdate": "2026-09-14T19:17:54.563Z",
  "executiveSummary": "This vulnerability involves a stack-based buffer overflow within the mtget binary of MikroTik RouterOS. The flaw resides in the TFTP RRQ (Read Request) builder function, which improperly validates the length of URL paths provided to the /tool fetch command. Affected products include MikroTik RouterOS versions prior to 7.23.4 (long-term) and 7.24.2 (stable).\nThe vulnerability allows an authenticated user, including those with minimal read-only permissions, to crash the mtget worker process. By providing a crafted tftp:// URL path exceeding 507 bytes, an attacker triggers a stack-based overflow that results in the overwriting of saved registers via an unbounded rep movsb instruction. This leads to a denial-of-service condition for the process. While currently categorized as a crashing vulnerability, the deterministic nature of the memory corruption and the ability to overwrite return addresses or saved register states often serves as a prerequisite for more sophisticated arbitrary code execution (ACE) attacks. The exploit does not require the presence of a functional TFTP server, nor does it necessitate administrative privileges, significantly lowering the barrier for exploitation by malicious actors who have gained basic access to the device.",
  "technicalDetails": "The vulnerability is rooted in the handling of TFTP request strings within the mtget binary, specifically during the construction of the RRQ packet. The application allocates a fixed-size stack buffer of 528 bytes intended to hold the TFTP URL path during the fetch process. However, the internal logic fails to implement adequate bounds checking before copying user-supplied input into this destination buffer.\nThe exploitation flow begins when an authenticated user issues a command via the /tool fetch interface, specifying a URI formatted as tftp://[path]. If the supplied [path] exceeds 507 bytes, the copy operation crosses the safety threshold of the allocated buffer. The process utilizes an unbounded rep movsb (Move String Byte) instruction to perform the memory transfer. Because the instruction is not constrained by the buffer size, it proceeds to overwrite adjacent stack memory once the 505-byte offset is reached.\nSpecifically, the overflow impacts the stack frame, where critical metadata, including saved base pointers and return addresses, are stored. By crafting a payload of 507 bytes or more, an attacker forces the overwrite of these saved registers. The deterministic offset ensures that the stack frame is corrupted in a predictable manner, which causes the execution flow to diverge from its intended path upon the function's return. This divergence results in an immediate crash of the mtget worker process, effectively inducing a denial-of-service.\nThe attack is notable for its lack of prerequisite network infrastructure; the target mtget binary does not verify the reachability of the destination TFTP server before processing the URL string, allowing the overflow to be triggered locally within the device's execution environment. The security impact is further amplified by the fact that the /tool fetch command is accessible to low-privileged users, such as those assigned to read-only groups. Although the primary observed impact is process termination, the primitive of unbounded memory corruption provides a potential vector for control-flow hijacking. Successful exploitation involves standardizing the input length to target specific control registers, which, if redirected to attacker-controlled instructions or existing gadgets in the binary, could lead to full system compromise. The vulnerability affects all RouterOS releases prior to the stable 7.24.2 and long-term 7.23.4 updates, necessitating an immediate transition to patched versions to prevent unauthorized process manipulation."
}