CVE-2024-27686
HighSummary
Mikrotik RouterOS versions 6.40.5 through 6.49.10 (fixed in 7) allow a remote attacker to cause a device crash via crafted packet data to the SMB service on TCP port 445.
Risk Assessment
An attacker can remotely cause a device crash, potentially leading to service availability disruptions within the organization.
Recommendation
It is recommended to upgrade RouterOS to version 7 or implement appropriate security measures to mitigate the risk of attack.
Other vulnerabilities in Mikrotik RouterOS
See all- CVE-2026-14227Medium
A product with the MikroTik RouterOS API enabled is vulnerable to insufficient session expiration. Active sessions may retain their previous permission set after inactivity timeouts or user-group changes.
- CVE-2026-16347High
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts.
- CVE-2026-39042High
A vulnerability in MikroTik RouterOS versions 7.21.x before 7.21.4 and 7.22.x before 7.22.2 exists in the unflatten() function of the libumsg.so library. A remote attacker can exploit this flaw to cause a denial of service (DoS).
- CVE-2023-47310Medium
A misconfiguration in the default settings of MikroTik RouterOS 7 allows incoming IPv6 UDP traceroute packets. The issue is fixed in version v7.14.
- CVE-2023-24094High
A vulnerability in the bridge2 component of MikroTik RouterOS version 6.40.5 allows attackers to cause a Denial of Service (DoS) by sending crafted packets.
Original NVD description (English source)
Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445.