Improper input validation in MikroTik RouterOS’s routing service allows an unauthenticated on‑path attacker to crash the BGP service. By sending a malformed MP_REACH_NLRI UPDATE packet whose prefix‑length is below the minimum valid for a labelled‑VPN NLRI, the code unwittingly processes a negative‑length address portion. This triggers an unhandled error that brings the BGP plane down, often terminating sessions without a NOTIFICATION and causing the device’s routing service to malfunction. The flaw can be exploited repeatedly with a single malicious UPDATE packet, allowing an attacker to hold the BGP plane indefinitely, thereby creating a sustained denial‑of‑service condition for VPN traffic.

MikroTik RouterOS, all releases prior to 7.25beta4, are susceptible. The flaw targets the BGP service component of RouterOS, so routers configured as BGP peers or providing VPN over BGP are affected.

With a CVSS base score of 8.7, this issue is high severity. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is an unauthenticated on‑path attacker who can inject malicious BGP UPDATE messages. By repeatedly sending MP_REACH_NLRI packets containing an out‑of‑bounds prefix‑length, the attacker can force the router’s BGP service to crash and remain unreachable, causing a persistent denial of service for VPN sessions.