{"id":"CVE-2026-89020","aliases":["EUVD-2026-77756","GHSA-66qh-8rrp-pqjv"],"status":"published","title":"MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path Leading to Privilege Escalation","description":"MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership. On older RouterOS versions, this overflow is not limited to crashing the process: the deterministic overwrite of saved registers is exploitable to achieve persistent privilege escalation on the device. On versions with intact exploit mitigations, the impact is limited to a crash of the mtget worker process.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00556,"percentile":0.46858,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-121"],"published":"2026-09-14T18:02:58Z","modified":"2026-11-06T21:32:02Z","exploits":[{"source":"pocgithub","id":"davtur19/PoC-CVE-2026-89020-PrivEsc","title":"davtur19/PoC-CVE-2026-89020-PrivEsc","date":"2026-10-30","url":"https://github.com/davtur19/PoC-CVE-2026-89020-PrivEsc"}],"products":[{"vendor":"mikrotik","product":"routeros"}],"references":[{"url":"https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800","tags":["patch","release-notes"]},{"url":"https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801","tags":["release-notes","patch"]},{"url":"https://www.vulncheck.com/advisories/mikrotik-routeros-stack-buffer-overflow-via-tftp-url-path","tags":["third-party-advisory"]},{"url":"https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","tags":["release-notes","patch"]},{"url":"https://mikrotik.com/supportsec/cve-2026-89020/","tags":["vendor-advisory"]},{"url":"https://gitlab.com/sys65535/CVE-2026-89020-privesc-research","tags":["technical-description","exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89020"},{"url":"https://mikrotik.com/supportsec/september-2026-vulnerability"},{"url":"https://mikrotik.com/supportsec/cve-2026-89020"},{"url":"https://github.com/advisories/GHSA-66qh-8rrp-pqjv"}],"sources":{"cve":[{"id":"CVE-2026-89020","title":"MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path Leading to Privilege Escalation","description":"MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership. On older RouterOS versions, this overflow is not limited to crashing the process: the deterministic overwrite of saved registers is exploitable to achieve persistent privilege escalation on the device. On versions with intact exploit mitigations, the impact is limited to a crash of the mtget worker process.","status":"published","published":"2026-09-14T18:02:58.553Z","modified":"2026-11-06T19:25:15.011Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-06T20:30:05.375225Z"}],"euvd":[{"id":"EUVD-2026-77756","description":"MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership. On older RouterOS versions, this overflow is not limited to crashing the process: the deterministic overwrite of saved registers is exploitable to achieve persistent privilege escalation on the device. On versions with intact exploit mitigations, the impact is limited to a crash of the mtget worker process.","status":"published","published":"2026-09-14T18:02:58Z","modified":"2026-11-06T19:25:15Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-06T20:06:05.048214Z"}],"ghsa":[{"id":"GHSA-66qh-8rrp-pqjv","title":"MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer...","description":"MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership.","status":"published","published":"2026-09-14T21:31:42Z","modified":"2026-11-06T21:32:02Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-06T21:34:16.869182Z"}],"nvd":[{"id":"CVE-2026-89020","description":"MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership. On older RouterOS versions, this overflow is not limited to crashing the process: the deterministic overwrite of saved registers is exploitable to achieve persistent privilege escalation on the device. On versions with intact exploit mitigations, the impact is limited to a crash of the mtget worker process.","status":"published","published":"2026-09-14T19:17:54.563Z","modified":"2026-11-06T20:17:27.91Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-121"],"updated_at":"2026-11-06T22:02:13.634375Z"}]}}