CVE-2026-93345

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 7.25beta4

Description An improper input validation issue exists in the labelled-VPN NLRI iterators of the routing service. An unauthenticated on-path attacker can crash the BGP service by sending a malformed MP REACH NLRI UPDATE message. This occurs when a prefix-length value below the minimum valid for a labelled-VPN NLRI is used, which allows the description of a route with a negative-length address portion. By repeatedly sending a BGP UPDATE packet containing a VPNv4 or VPNv6 NLRI with an out-of-bounds prefix-length, an attacker can indefinitely hold down the BGP plane, leading to session termination without a NOTIFICATION and causing a service malfunction on the device.

Recommendations Update to version 7.25beta4.