Executive brief
MikroTik RouterOS includes an SMB file-sharing service that can be accessed from the network. An unauthenticated attacker can exploit a flaw in how the SMB daemon processes login requests to read sensitive data from the router's memory, potentially exposing configuration details, credentials, or other confidential information without authentication.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in the userspace SMB daemon's SessionSetupAndX handler. An attacker can craft a minimal SMB1 SessionSetupAndX frame with a malicious uniPwdLen field value to trigger a read beyond the end of the request buffer. The flaw occurs before credential validation, meaning no SMB authentication is required. A network-based attacker can read arbitrary memory contents, potentially exposing sensitive data from the router process. The vulnerability is fixed in RouterOS 7.24 and later; affected versions include 6.49.18 and earlier, and 7.0.0 through 7.23.x.
Affected products
- MikroTik RouterOS before 7.24; specifically 6.49.18 and earlier, 7.0.0–7.23.x
Timeline
- 2026-09-16: disclosed: CVE-2026-56719 disclosed
- 2026-08-14: patched: Fix included in RouterOS 7.24 stable release