MikroTik RouterOS < 7.24 Web Management Integer Underflow RCE (CVE-2026-84411)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362603);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2026-84411");
  script_xref(name:"IAVA", value:"2026-A-1068");

  script_name(english:"MikroTik RouterOS < 7.24 Web Management Integer Underflow RCE (CVE-2026-84411)");

  script_set_attribute(attribute:"synopsis", value:
"The remote networking device is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the remote networking device is running a version of
MikroTik RouterOS prior to 7.24. It is, therefore, affected by a remote code execution
vulnerability.

The web management service in affected RouterOS versions contains an integer underflow in its HTTP
request body handling that is reachable before authentication. This can be leveraged by an
unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial
of service, using a single crafted request. (CVE-2026-84411)

Note that Nessus has not tested for this issue but has instead relied only on the router's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06");
  script_set_attribute(attribute:"see_also", value:"https://mikrotik.com/download");
  script_set_attribute(attribute:"solution", value:
"Upgrade to MikroTik RouterOS 7.24 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-84411");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mikrotik:routeros");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mikrotik_detect.nasl", "ssh_detect.nasl");
  script_require_keys("MikroTik/RouterOS/Version");

  exit(0);
}

include('vcf.inc');

var app = 'MikroTik';
var kb_ver = 'MikroTik/RouterOS/Version';

var app_info = vcf::get_app_info(app:app, kb_ver:kb_ver);

var constraints = [
  { 'fixed_version' : '7.24' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE, strict:FALSE);