CVE-2026-93345— MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI
Quick assessment
Affected
MikroTik RouterOS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MP_REACH_NLRI UPDAT
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-93345
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI
Source: CVE Program / CVE List V5
Vulnerability Description
MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MP_REACH_NLRI UPDATE message with a prefix-length value below the minimum valid for a labelled-VPN NLRI, which passes validation while describing a route with a negative-length address portion. Attackers can repeatedly send a single BGP UPDATE packet carrying a VPNv4 or VPNv6 NLRI with an out-of-bounds prefix-length to indefinitely hold down the BGP plane, causing session termination without a NOTIFICATION and triggering a service malfunction on the device.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1284
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-93345
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-93345
请登录查看更多情报信息。
Other References for CVE-2026-93345 (2)
IV. Related Vulnerabilities
Same product: RouterOS
-
CVE-2026-89028
MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSet -
CVE-2026-56719
MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 Session -
CVE-2026-89021
MikroTik RouterOS Path Traversal via Container OCI/tar Image -
CVE-2026-89020
MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path -
CVE-2026-86060
SSH session privilege manipulation via a crafted username in
Same vendor: MikroTik
-
CVE-2026-89028
MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSet -
CVE-2026-56719
MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 Session -
CVE-2026-89021
MikroTik RouterOS Path Traversal via Container OCI/tar Image -
CVE-2026-89020
MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path -
CVE-2026-86060
SSH session privilege manipulation via a crafted username in
Same weakness: CWE-1284
-
CVE-2026-94450
Potential denial of service when configured to send Retry pa -
CVE-2026-89420
Session voucher adding no new funds is accepted without a ch -
CVE-2026-93749
source-map-js through 1.2.1 Event Loop Denial of Service -
CVE-2025-36178
Multiple vulnerabilities in IBM Controller -
CVE-2026-50285
Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Deco
V. Comments for CVE-2026-93345
No comments yet