MikroTik RouterOS (CVE-2026-84411)
MikroTik RouterOS versions below 7.24 contain a pre-auth integer underflow in the web management service enabling unauthenticated remote code execution as root or denial of service. An unauthenticated network attacker can exploit CVE-2026-84411 by sending a single crafted HTTP request to the web management service before authentication. The integer underflow in request body handling permits arbitrary code execution with root privileges or system crash.
Detection / Hunteropenrouter
Immediate Actions
- Upgrade RouterOS to version 7.23 or later on all affected devices.
- Restrict web management interface access to trusted internal networks only.
Key Takeaways
- CVSS v3.1 base score is 9.8 Critical; CVSS v4.0 score is 9.3 Critical.
- Vulnerability is reachable before authentication via a single crafted HTTP request.
- Root-level code execution is achievable, not just user-level compromise.
- Fix is to upgrade RouterOS to version 7.23 or later.
- No known public exploitation reported as of 2026-09-29.
Attack Chain
- Initial Access: Unauthenticated attacker sends crafted HTTP request to RouterOS web management service
- Exploitation: Integer underflow triggered in HTTP request body parsing before authentication
- Execution: Arbitrary code execution achieved with root privileges
- Impact: Full device compromise or denial of service via single request
Affected Systems
- MikroTik RouterOS versions prior to 7.24
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-84411 | MikroTik RouterOS (web management service) | Critical | Integer underflow in HTTP request body handling allows pre-auth remote code execution as root or denial of service. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | RouterOS is a network appliance OS; EDR agents are typically not installed. |
| Network Visibility | High | Single crafted HTTP request to web management port is detectable via network monitoring. |
| Detection Difficulty | Moderate | Need to identify anomalous HTTP request bodies targeting the management interface pre-auth. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unauthenticated HTTP requests with malformed body lengths targeting RouterOS web management port indicate exploitation of CVE-2026-84411 (T1190). | Network flow and HTTP proxy logs | Initial Access | Medium — legitimate management traffic may share port |
Required Log Sources
- RouterOS audit logs
- Network firewall logs
- Web application firewall logs
Key Behavioral Indicators
- Unauthenticated HTTP requests to RouterOS web management port
- Abnormally sized or malformed HTTP request body fields
- Sudden service crash events on RouterOS web service
Control Gaps
- No authentication required to reach vulnerable code path
- Network firewalls may allow management interface exposure
False Positive Assessment
Low — unauthenticated HTTP requests with malformed body data to RouterOS web management are unusual in normal operations.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Place RouterOS management interfaces behind firewalls isolated from business networks.
- Disable web management if SSH or WinBox is available as alternatives.
- Use VPN for remote access to router management interfaces.
MITRE ATT&CK Mapping
Initial Access
Plain-Language Summary
MikroTik routers running software older than version 7.24 have a security flaw in their web management interface that lets attackers take full control without needing a password. The flaw involves a calculation error in handling web requests that can be triggered by a single specially crafted message. Anyone using affected routers should update to version 7.23 or newer immediately and keep the router's management interface off the public internet.
- cveCVE-2026-84411Integer underflow in HTTP request body handling allows pre-auth remote code execution as root or denial of service.