An unauthenticated remote attacker can trigger a kernel restart or disclose sensitive memory contents in MikroTik RouterOS by sending specially crafted bandwidth-test packets.

The bandwidth-test service improperly allows unauthenticated connections to reach a state intended only for authenticated users. By exploiting integer underflow and uninitialized kernel memory disclosure, an attacker can crash the system kernel.

Successful exploitation of this vulnerability results in a denial of service, forcing a system restart of the affected network device. This can lead to significant network outages and disruption of critical business communications. With a CVSS score of 8.8, the vulnerability is classified as high severity, particularly because it can be triggered by an unauthenticated attacker over the network.

Immediate Action: Update all MikroTik RouterOS devices to version 6.49.21, 7.23.4, or 7.24.2 immediately. These versions contain the necessary security patches to prevent the identified exploitation chain.

Proactive Monitoring: Review system logs for signs of device reboots, unusual bandwidth-test activity, or the presence of the "Flagged" marker in the output of the /system/device-mode/print command.

Compensating Controls: Disable the bandwidth-test service if it is not required for network operations. Restrict access to management and diagnostic services to trusted IP addresses using firewall rules to prevent unauthorized access.

Public Exploit Available: Yes (a technical write-up containing the attack detail is referenced by the CVE record).

The severity of this vulnerability is elevated by confirmed active exploitation in the wild. Administrators must prioritize updating all RouterOS devices to the latest patched versions immediately. After patching, it is critical to perform a thorough audit of the device configuration for unauthorized users, scripts, or scheduled tasks that may have been introduced during a potential compromise.