7.1
High
CVE-2026-112158 A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8
Description
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RouterOS 7.23 | earliest → < 7.23.1 | 7.23.1 |
| RouterOS 7.21 | earliest → < 7.21.5 | 7.21.5 |
| RouterOS 7.20 | 7.20.0 → 7.20.8 | No fix stated |
| RouterOS | 6.44 | No fix stated |
| RouterOS | 6.43 | No fix stated |
| RouterOS | 6.42 | No fix stated |
| RouterOS | 6.41 | No fix stated |
| RouterOS 6.40 | 6.40 → 6.40.5 | No fix stated |
| RouterOS | 6.39 | No fix stated |
Show the 39 other branches Hide the 39 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| RouterOS | 6.38 | No fix stated |
| RouterOS | 6.37 | No fix stated |
| RouterOS | 6.36 | No fix stated |
| RouterOS | 6.35 | No fix stated |
| RouterOS | 6.34 | No fix stated |
| RouterOS | 6.33 | No fix stated |
| RouterOS | 6.32 | No fix stated |
| RouterOS | 6.31 | No fix stated |
| RouterOS | 6.30 | No fix stated |
| RouterOS | 6.29 | No fix stated |
| RouterOS | 6.28 | No fix stated |
| RouterOS | 6.27 | No fix stated |
| RouterOS | 6.26 | No fix stated |
| RouterOS | 6.25 | No fix stated |
| RouterOS | 6.24 | No fix stated |
| RouterOS | 6.23 | No fix stated |
| RouterOS | 6.22 | No fix stated |
| RouterOS | 6.21 | No fix stated |
| RouterOS | 6.20 | No fix stated |
| RouterOS | 6.19 | No fix stated |
| RouterOS | 6.18 | No fix stated |
| RouterOS | 6.17 | No fix stated |
| RouterOS | 6.16 | No fix stated |
| RouterOS | 6.15 | No fix stated |
| RouterOS | 6.14 | No fix stated |
| RouterOS | 6.13 | No fix stated |
| RouterOS | 6.12 | No fix stated |
| RouterOS | 6.11 | No fix stated |
| RouterOS | 6.10 | No fix stated |
| RouterOS | 6.9 | No fix stated |
| RouterOS | 6.8 | No fix stated |
| RouterOS | 6.7 | No fix stated |
| RouterOS | 6.6 | No fix stated |
| RouterOS | 6.5 | No fix stated |
| RouterOS | 6.4 | No fix stated |
| RouterOS | 6.3 | No fix stated |
| RouterOS | 6.2 | No fix stated |
| RouterOS | 6.1 | No fix stated |
| RouterOS | 6.0 | No fix stated |
Other CVEs of RouterOS
The 26 CVEs of RouterOS →
CVE-2026-89035
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows…
9.1
Critical
CVE-2026-103903
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote…
8.7
High
CVE-2026-84411
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling…
9.8
Critical
CVE-2026-93345
MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI…
8.7
High