9.8
Critical
CVE-2026-84411 The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling…
Description
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RouterOS 7.24 | earliest → < 7.24 | 7.24 |
Other CVEs of RouterOS
The 26 CVEs of RouterOS →
CVE-2026-89035
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows…
9.1
Critical
CVE-2026-112158
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8
7.1
High
CVE-2026-103903
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote…
8.7
High
CVE-2026-93345
MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI…
8.7
High