A critical buffer overflow vulnerability in MikroTik RouterOS 7 poses a significant risk of remote code execution or system instability due to improper JSON input validation.

This is a memory corruption vulnerability (CWE-120, CWE-119) occurring within the parse_json_element function of libjson.so. The vulnerability is triggered by sending specially crafted JSON payloads containing malformed Unicode escape sequences, which leads to an out-of-bounds access condition. The vulnerability is exploitable by an authenticated user with low-level privileges.

The potential for memory corruption and buffer overflow in a core networking component like RouterOS carries severe risks, including potential remote code execution, unauthorized system access, or persistent denial of service. Given the CVSS score of 8.8, this vulnerability is classified as High severity. Successful exploitation could lead to full compromise of network infrastructure, threatening data integrity and operational continuity.

Immediate Action: Update MikroTik RouterOS to version 7.20.1 or 7.21beta2 immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor device logs for unusual system crashes or repeated authentication/parsing errors that may indicate an exploitation attempt.

Compensating Controls: Implement strict network ingress filtering to ensure only trusted sources can reach the management interface, and utilize a Web Application Firewall or similar inspection tool to drop malformed JSON packets.

Public Exploit Available: Yes, a technical proof-of-concept and vulnerability analysis are available via the referenced GitHub repository.

The severity of this memory corruption vulnerability necessitates immediate attention from all administrators managing MikroTik RouterOS 7 environments. Because a functional proof-of-concept is publicly available, the window for remediation is narrow. Organizations should prioritize patching to the recommended versions to eliminate this critical attack vector and prevent potential compromise of their network edge devices.