MikroTik RouterOS Integer Overflow in IPC Library

Vulnerability Overview Vulnerability Name: Integer Overflow Vulnerability Vulnerability Location: MikroTik RouterOS Core IPC Library ( ) Vulnerability Type: Integer Overflow Description: In the function, a 32-bit integer overflow occurs when adding the 4-byte length value read from the network to the current pointer position while processing LONG string fields. This may lead to out-of-bounds buffer access, potentially resulting in a Denial of Service (DoS) or Remote Code Execution (RCE). Scope of Impact Affected Versions: All RouterOS 7.x versions, including the latest 7.22.1 Affected Services: All network services utilizing the library, including SSH, HTTP, FTP, Telnet, Winbox, etc. Default Configuration: Under default configurations, multiple services are exposed, increasing the attack surface. Remediation Current Status: As of 2026-03-31, the vulnerability has been identified and verified, but no patch has been released yet. Recommended Actions: - Update RouterOS to the latest version (once a fix is released). - Restrict network access, allowing only necessary service ports. - Implement monitoring and logging to detect anomalous behavior promptly. POC Code Additional Information Binary Hardening Status: - RouterOS 7.20.8 (x86): NX (DEP) disabled, PIE/ASLR disabled, Stack Protection disabled, FORTIFY_SOURCE disabled, Partial RELRO - RouterOS 7.22.1 (ARM, latest): NX (DEP) enabled, PIE/ASLR disabled, Stack Protection disabled, FORTIFY_SOURCE disabled, Partial RELRO Verification Results: - Tested on a RouterOS 7.22.1 device, confirming the integer overflow behavior. - Post-overflow verification was observed in the SSH path, although wrap-around values were captured. - Similar issues exist in other service paths. Unresolved Findings: - HTTP Header Overflow: The web server enforces strict input restrictions. - SSH Integer Overflow as RCE: Although the overflow is genuine, the SSH code includes post-overflow checks. - Direct Shellcode Execution: With NX enabled, direct shellcode execution failed. Disclosure Timeline 2026-03-31: Vulnerability identified and verified. 2026-03-31: Disclosed to the security team.

Goal Reached Thanks to every supporter — we hit 100%!

MikroTik RouterOS Integer Overflow in IPC Library