RouterOS permits a "btest" connection from an unauthenticated client before the primary session is authenticated, allowing the attacker to initiate an IPv4 UDP test with "random-data=false". This causes the service to transmit an uninitialised tail from a kernel packet buffer, exposing kernel memory. A second unchecked, inverted packet-size interval triggers an unsigned integer underflow that produces an anomalously large fragmented output, ultimately causing the RouterOS kernel to reboot. The result is a vulnerability that discloses kernel memory and can force a denial of service for the device.

MikroTik RouterOS devices running any firmware version prior to the releases that include the fix are affected. The patch was applied in Firmware 6.49.21 (.4 (Long‑term) and 7.24.2 (Stable). All other MikroTik RouterOS versions remain vulnerable until updated.

The CVSS score of 8.8 indicates a high level of severity. The vulnerability has also been added to CISA's Known Exploited Vulnerabilities catalog, indicating confirmed exploitation. The EPSS score is 0.00435 (0.435%) and, along with active exploitation reports, indicates a realistic exploitation risk. Attackers can gain access to the btest service from any IP that can reach the device; no attacker can both learn sensitive information from the kernel memory and repeatedly crash the router, rendering it unusable for legitimate network operations.