CVE-2026-112158

MediumCVSS 6.5/10Last modified Oct 19, 2026

Description

A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the file ipt_SAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address this issue. You should upgrade the affected component.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-189 CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1121595.5A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Templat CVE-2026-112164.3Incorrect security UI in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spec CVE-2026-1121618.5MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker wi CVE-2026-1121646.6The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with ac CVE-2026-1121656.9The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the CVE-2026-1121686.0The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedde CVE-2026-1121696.1Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user accou CVE-2026-112176.5Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rend CVE-2026-1121706.3The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.CVE-2026-1121714.4An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to, modification of, or disclosu CVE-2026-1121728.1CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute CVE-2026-1121749.3Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface runnin