CVE-2021-36614: Mikrotik RouterOs before stable 6.48.2 suffers from a memory corruption vulnerability in the tr069-client p...

Security readout for executives and security teams

This issue affects MikroTik RouterOS versions before stable 6.48.2. An authenticated remote attacker could crash the TR-069 client process through a memory corruption flaw, causing denial of service. The public record does not show confirmed active exploitation. Exposure is most relevant for MikroTik RouterOS devices older than stable 6.48.2 where the tr069-client process is present or enabled, especially when authenticated management or TR-069-related access is available to untrusted parties. Treat this as a targeted operational availability risk for MikroTik router fleets, not a confirmed mass-exploitation emergency. Prioritize upgrades where affected routers support business-critical connectivity or remote management exposure is broad. Mitigation focus: Upgrade MikroTik RouterOS to stable 6.48.2 or later where feasible.; Check MikroTik guidance for any model-specific or branch-specific upgrade notes.; Restrict authenticated management access to trusted users and networks..

Prepared

Jun 2, 2026, 09:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.