MikroTik RouterOS 6.x < 6.49.21 / 7.0.x < 7.23.4 / 7.24.x < 7.24.2 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(344588);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/10");

  script_cve_id("CVE-2026-67277", "CVE-2026-67279", "CVE-2026-86060");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/09/13");

  script_name(english:"MikroTik RouterOS 6.x < 6.49.21 / 7.0.x < 7.23.4 / 7.24.x < 7.24.2 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote networking device is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the remote networking device is running a version of
MikroTik RouterOS 6.x prior to 6.49.21, or 7.0.x prior to 7.23.4, or 7.24.x prior to 7.24.2. It is,
therefore, affected by multiple vulnerabilities :

  - RouterOS accepts a 'related' btest connection before the corresponding primary session has
    completed authentication. An unauthenticated client can use this state to start an IPv4 UDP
    test. With 'random-data=false', the sender transmits an uninitialized tail from a kernel packet
    buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow,
    anomalously large fragmented output, and can restart the RouterOS kernel. (CVE-2026-67277)

  - RouterOS contains an argument-handling flaw in the SSH login path involving usernames that
    begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed,
    leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach
    the RouterOS login helper. (CVE-2026-86060)

  - RouterOS SSH enters the connection protocol after a client-requested rekey even though user
    authentication was never attempted, allowing an unauthenticated client to open a session
    channel and send an exec request. On affected builds the server dispatches the command,
    enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS
    managed file namespace, including support files containing configuration and diagnostic data.
    (CVE-2026-67279)

Note that Nessus has not tested for this issue but has instead relied only on the router's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://mikrotik.com/supportsec/september-2026-vulnerability/");
  script_set_attribute(attribute:"see_also", value:"https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve");
  # https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1fe530bb");
  script_set_attribute(attribute:"solution", value:
"Upgrade to MikroTik RouterOS 6.49.21, 7.23.4, 7.24.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-67277");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-86060");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-86060");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mikrotik:routeros");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mikrotik_detect.nasl", "ssh_detect.nasl");
  script_require_keys("MikroTik/RouterOS/Version");

  exit(0);
}

include('vcf.inc');

var app = 'MikroTik';
var kb_ver = 'MikroTik/RouterOS/Version';

var app_info = vcf::get_app_info(app:app, kb_ver:kb_ver);

var constraints = [
  { 'min_version' : '6.0.0', 'fixed_version' : '6.49.21' },
  { 'min_version' : '7.0.0', 'fixed_version' : '7.23.4' },
  { 'min_version' : '7.24', 'fixed_version' : '7.24.2' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE, strict:FALSE);