RouterOS versions in the affected ranges should be upgraded to their matching fixed release or a later supported release. CVE-2026-67277 is a pre-authentication bandwidth-test flaw that can disclose a small amount of kernel-buffer memory or cause a router/kernel restart. Check the installed version, limit untrusted access to router services, and investigate unfamiliar configuration changes rather than treating a successful update as proof that a device was never compromised.
What CVE-2026-67277 does
CERT Polska describes a flaw in RouterOS bandwidth testing (btest): a related bandwidth-test connection can be accepted before authentication of its corresponding primary session has finished. That timing can let an unauthenticated client start an IPv4 UDP test.
As an Amazon Associate I earn from qualifying purchases.
In CERT Polska’s technical account, when random-data=false, the sender can transmit an uninitialized tail from a kernel packet buffer. The report also describes an unchecked, inverted packet-size interval that triggers unsigned integer underflow and anomalously large fragmented output, potentially restarting the RouterOS kernel. MikroTik’s summary describes the possible outcomes as a router crash or disclosure of small amounts of memory contents. CERT Polska’s technical description and MikroTik’s advisory cover the issue.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThis is not the separate SSH remote-command issue, CVE-2026-67279. The September 2026 disclosure covered six RouterOS vulnerabilities, including SSH and WebFig issues. Reports of exploitation involving related SSH flaws do not establish that attackers used CVE-2026-67277 specifically.
#1 Best Overall
- hEX also known as RB750Gr3 is a five port Gigabit Ethernet router for locations where wireless connectivity is not required
- The device has a full size USB port. This new updated revision of the hEX brings several improvements in performance
- It is affordable, small and easy to use, but at the same time comes with a very powerful dual core 880MHz CPU and 256MB RAM
- IPsec hardware encryption (~470 Mbps) and The Dude server package is supported, microSD slot on it provides improved r/w speed for file storage and Dude
- Dimensions: 113x89x28mm; Storage size: 16 MB; Passive PoE (PoE in); PCB temperature monitor, Voltage monitor and Mode button
Which RouterOS versions are affected, and which fix applies?
CERT Polska lists these affected ranges. The fixed release is the first version shown in the right-hand column for the corresponding branch; install that release or a later supported release.
| Affected RouterOS range | Fixed release |
|---|---|
| 7.24 up to, but not including, 7.24.2 | 7.24.2 |
| 7.0.0 up to, but not including, 7.23.4 | 7.23.4 |
| 6.0.0 up to, but not including, 6.49.21 | 6.49.21 |
Use the fixed release for the device’s branch, or a later supported release that suits its update channel and operational requirements. Check the version on the device after upgrading. The Canadian Centre for Cyber Security’s AL26-020 alert gives corresponding Stable, Long-Term and 6.x release guidance.
Rank #2
- Wired Gigabit Router – 5x Gigabit Ethernet ports, 2.5G SFP, PoE-Out, USB, powered by RouterOS
Do not confuse these fixes with later corrective releases for CVE-2026-67278, a separate certificate and SSH host-key issue. That issue required 7.24.3 and 7.23.6 after incomplete fixes in 7.24.2 and 7.23.4; it does not change the fixed-version guidance for CVE-2026-67277.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →How to reduce exposure and patch safely
- Inventory devices. Record each managed router’s RouterOS version, update channel, and reachability from untrusted networks. Prioritize devices running an affected version and devices whose services are internet-accessible. The Canadian Centre’s alert recommends version inventory and prioritizing exposed systems.
- Review actual service reachability. Restrict router services to trusted source addresses, disable services that are not needed, and use a VPN for remote administration where appropriate. Specifically assess whether bandwidth-test is reachable on each device; do not infer its exposure from firewall behavior for another service.
- Choose the matching update. Select the fixed release for the device’s affected branch, or a later supported release, and account for operational compatibility and your maintenance window. MikroTik recommends keeping RouterOS current and preventing web and other management services from being reachable from untrusted networks in its security advisory.
- Install and verify. Complete the upgrade using your normal RouterOS maintenance process, then confirm the device reports the intended version. A scheduled or attempted update is not verification that the fixed software is running.
MikroTik notes that its default firewall blocks internet access to the web interface. That statement is about the web interface; it does not establish that bandwidth-test is blocked by default on every installation. Verify the device’s actual configuration and network exposure.
How to check for signs of compromise
After patching, review RouterOS logs for a critical entry indicating that the device has been Flagged. MikroTik says RouterOS checks for signs of compromise and may mark a device Flagged. Treat that status as a useful warning, not as a comprehensive compromise detector: absence of a Flagged entry does not prove the router is clean.
- Inspect user accounts for unfamiliar entries.
- Review scripts and configuration for changes that administrators do not recognize.
- Monitor authentication logs and network activity for unauthorized access or other unexpected behavior.
- Preserve relevant logs and configuration data if you find suspicious changes, and follow your organization’s incident-response process before returning the router to normal operation.
These are general operational checks, not CVE-2026-67277-specific signatures. The sources cited here do not provide a validated detection rule or an indicator of compromise unique to this bandwidth-test flaw. For response context, see DIVD CSIRT’s case information and the Canadian Centre’s alert.
Rank #4
- MikroTik RouterBOARD C52iG-5HaxD2HaxD-TC-US (US Version) hAP ax (WiFi6) Quad-Core IPQ-6010 864 MHz, RAM 1GB, RouterOS, License level 4 It's time to supercharge your home network with the Generation
- hAP ax has everything you might need in a primary home access point - and more
- Forget endless reviews and comparisons - this is the perfect device for 99% of homes
- Wireless signal is now stronger than ever
- Here are the two main ingredients of hAP ax's success: a state-of-the-art dual-band, dual-chain 4-4
What exploitation reporting does—and does not—show
The Canadian Centre for Cyber Security reported that CISA added CVE-2026-67277 and CVE-2026-86060 to its Known Exploited Vulnerabilities database on September 10, 2026. Separately, DIVD reports that the Netherlands NCSC said CERT Polska observed active exploitation against MikroTik routers with publicly accessible SSH, combining multiple vulnerabilities to gain full control.
Those reports make prompt patching and exposure reduction important, but they do not attribute the observed multi-vulnerability attacks specifically to CVE-2026-67277. Keep the bandwidth-test flaw distinct from the related SSH vulnerabilities when assessing an incident.
Quick Recap
Best Value
- W128339515
Disclosure timeline
- September 3, 2026: MikroTik published its RouterOS vulnerability notice.
- September 5, 2026: CERT Polska published its vulnerability records and attributed discovery to researcher Sławomir Rozbicki, who participated in coordinated disclosure.
- September 10, 2026: The Canadian Centre for Cyber Security published alert AL26-020 and reported CISA KEV additions for CVE-2026-67277 and CVE-2026-86060.
- October 6, 2026: MikroTik updated its advisory to identify all six CVEs and clarify the complete fixed version for the separate CVE-2026-67278 issue.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
