Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a vulnerability in MikroTik's RouterOS that allows an unauthenticated user to exploit a flaw in the connection authentication process. This can lead to the disclosure of kernel memory and potentially a denial of service by restarting the system.
- Unauthenticated access can expose sensitive data.
- Affects network edge devices, a critical infrastructure component.
- Confirm relevance and assess exposure of network devices.
Attack Path
How an attacker could exploit the issue
An attacker can initiate a connection to a vulnerable RouterOS device that is exposed to the internet. The device may incorrectly allow a "related" connection before the primary authentication is finished. This allows the attacker to trigger an IPv4 UDP test, which, under specific conditions, sends uninitialized kernel memory data and can cause the device's kernel to restart.
- Unauthenticated network access required.
- Triggered by a malformed UDP test connection.
- Can lead to kernel restart and denial of service.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to send specially crafted packets to a MikroTik router, exploiting a weakness in how the "btest" service handles connections before full authentication. This could lead to the disclosure of uninitialized kernel memory and potentially cause the router's kernel to restart, resulting in a denial of service.
- Router kernel memory and service availability.
- Unauthenticated network access to the btest service.
- Service disruption or kernel restart.
Operational Fix
Recommended remediation, mitigation, and detection steps
Action for this high-severity vulnerability typically falls to network infrastructure or platform teams responsible for managing MikroTik devices. The first practical step is to identify all instances of the affected RouterOS, determine their internet exposure and business criticality, and then locate the accountable owner for remediation planning.
- Network infrastructure teams own this issue.
- Verify internet-facing router exposure.
- Plan urgent vendor-guided updates.
