RouterOS permits a "btest" connection from an unauthenticated client before the primary session is authenticated, allowing the attacker to initiate an IPv4 UDP test with "random-data=false". This causes the service to transmit an uninitialised tail from a kernel packet buffer, exposing kernel memory. A second unchecked, inverted packet-size interval triggers an unsigned integer underflow that produces an anomalously large fragmented output, ultimately causing the RouterOS kernel to reboot. The result is a vulnerability that discloses kernel memory and can force a denial of service for the device.

MikroTik RouterOS devices running any firmware version prior to the releases that include the fix are affected. The patch was applied in Firmware 6.49.21 (Long‑term), 7.23.4 (Long‑term) and 7.24.2 (Stable). All other MikroTik RouterOS versions remain vulnerable until updated.

The CVSS score of 8.8 indicates a high level of severity. Although the EPSS score is not publicly available, the vulnerability is actively exploited as noted in vendor and security advisory references, implying a realistic exploitation risk. Attackers can gain access to the btest service from any IP that can reach the device; no authentication is required. Once exploited, the attacker can both learn sensitive information from the kernel memory and repeatedly crash the router, rendering it unusable for legitimate network operations.