{"id":"CVE-2026-84411","published":"2026-10-02T23:16:58.417","lastModified":"2026-10-06T15:15:48.310","description":"The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-191"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-06.json","tags":[]},{"url":"https://mikrotik.com/download","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-06.json","tags":[]}],"hasPoc":true,"ai":{"summary":"This flaw involves an integer underflow in HTTP request body handling in RouterOS, allowing unauthenticated attackers to execute arbitrary code as root or cause a denial of service.","exploitability":"Exploitation is relatively straightforward as it requires only a single crafted request from an unauthenticated attacker.","blast_radius":"If exploited, the impact could be severe, including full system compromise or service disruption.","remediation":"Upgrade to RouterOS 7.40.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","auth-bypass","dos","routeros"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:45:31.284Z"}}