CVE-2026-112158: MikroTik RouterOS ipt_SAME.ko same_check integer overflow
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function samecheck of the file iptSAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MikroTik RouterOSto a version that resolves this vulnerability.Fixed in 7.21.5 - Upgrade
Upgrade
MikroTik RouterOSto a version that resolves this vulnerability.Fixed in 7.23.1
Event History
Frequently Asked Questions
Which RouterOS versions are identified as affected?
The issue affects MikroTik RouterOS through versions 6.40.5, 6.44, and 7.20.8. The provided remediation recommends upgrading to 7.21.5 or 7.23.1.
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable and has low attack complexity. The supplied severity vector indicates that the attacker requires low-level privileges and does not require user interaction.
What is the primary impact of successful exploitation?
Successful manipulation of the affected same_check function can cause an integer overflow. The severity vector identifies availability impact as high, with no stated confidentiality or integrity impact.