Proof-of-concept privilege escalation for CVE-2026-89020: exploits a RouterOS mtget TFTP RRQ overflow to rewrite group policy and promote a read-only user to full admin.
Original overflow (DoS): Kazuma Matsumoto, GMO Cybersecurity by IERAE.
Privilege escalation from read-only: Cristiano Maranci, Davide Turaccio.
An authenticated user in the read group rewrites the stored group policy through the mtget TFTP overflow and gets full privileges on unpatched RouterOS. MikroTik reproduced it. This repo is the escalation PoC, not the original overflow.
| Build | mtget sha256 (16) | Vulnerable |
|---|---|---|
| 6.49.7 | c86bad170066c058 | yes |
| 6.49.11 | c86bad170066c058 | yes (tested on live device) |
| 6.49.18 | a98020b2d5e39cf3 | yes |
| 6.49.19 | a98020b2d5e39cf3 | yes |
| 6.49.20 | a98020b2d5e39cf3 | yes |
| 6.49.21 | 9721d0bb5d21ec2a | no (fix) |
| 6.49.22 | 9721d0bb5d21ec2a | no |
| 7.23.3 | 0a976b16314073e7 | yes |
| 7.23.7 | b315c9516f67c078 | no (fixed in 7.23.4) |
| 7.24.1 | e5cba2a80146f361 | yes |
| 7.24.2 | a6a8b50ee270e018 | no (fix) |
| 7.24.5 | 13dafb8a1d28fac7 | no |
Vulnerable in every sampled 6.x build from 6.0 to 6.49.20 and every sampled 7.x build from 7.1.5 to 7.24.1. Fixes: 6.49.21, 7.23.4, 7.24.2. Escalation tested on 6.49.11 (RB SXT-5D) and 6.49.18 (RB433GL).
mtget RRQ builder: unbounded memcpy (6.49.11: builder 0x406518, copy 0x406558). A long tftp:// path via /tool fetch overwrites saved registers and the return address./rw/store/group.dat, writes the first record prefix (38 bytes), reads it back, writes a marker file, exits.group::restore in /nova/bin/user (6.49.11: 0x40c348) applies allow & clip and deny & clip with no value validation. The read group becomes the full group.python3 poc_read2full.py --host H --port P --user U --password W
python3 poc_read2full_generic.py --host H --port P --user U --password W \
--payload payloads/6.49.7-6.49.11.mipsbe.bin
poc_read2full.py is the tested 6.49.11 driver. poc_read2full_generic.py also accepts 6.49.7, or another build with a recalculated payload.
--promote-user NAME optionally moves that account to full after the rewrite.
payloads/6.49.7-6.49.11.mipsbe.bin (4094 B, sha256 433d59c9...) is the payload used in the live runs. Other builds need a recalculated payload.
Only run it on devices you own or are authorized to test. It rewrites the read group policy and may reboot the device.