CVE-2026-89020

MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) is affected by a stack-based buffer overflow in the mtget binary's TFTP RRQ builder function. An authenticated user with read-only group membership can issue a /tool fetch command with a crafted tftp:// URL path of 507 bytes or more ...

PT-2026-91400

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 7.23.4 long-term RouterOS versions prior to 7.24.2 stable Description A stack-based buffer overflow exists in the TFTP RRQ builder function of the mtget binary. Authenticated users with read-only group membership can...