Medium [CVE-2026-89020] MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes
This medium-severity MikroTik advisory covers CVE-2026-89020 affecting MikroTik RouterOS.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Android app · Google Play
Monitor future MikroTik CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
A buffer overflow vulnerability has been identified in the “fetch” tool of RouterOS (/tool fetch), when it is given a very long tftp:// address. A logged-in user can use this to crash the fetch process.
The issue has been assigned CVE-2026-89020. Who is affected: RouterOS versions 6 and 7 before the fixed releases listed below.
To trigger the issue, the attacker needs a valid username and password on the router. Even a read-only user can trigger it, so this matters for devices with multiple user accounts or shared logins.
Although the public report describes a crash, we treat this issue seriously, because memory corruption issues of this type can sometimes be abused for more than a crash. We recommend upgrading rather than relying on the limited user rights of your accounts.
This issue is fixed in: 7.24.2 (stable). 7.23.4 (long-term).
Users are advised to upgrade to one of these versions or any later release. Until you upgrade, review the user accounts on your router, remove accounts that are no longer needed, and make sure management services are not reachable from untrusted networks.
Affected product named by the advisory: MikroTik RouterOS.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
- 7.23.4
- 7.24.2
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Mitigation checklist
- MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall to limit exposure from untrusted networks.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.