MikroTik RouterOS EUVD-2026-104417

Requires an authenticated session (PR:L) on a RouterOS device with privileges to add/modify firewall or NAT rules, plus the ability to install an ipt_SAME (SAME target) rule carrying the manipulated range/count value that overflows in same_check; the management plane must be reachable over the network (AV:N, e.g., Winbox/API/SSH). Limiting factors: exploitation is not anonymous - valid credentials with firewall-config permission are mandatory, and impact is confined to availability (device crash/brick) with no confidentiality or integrity effect, so the realistic risk is insider misuse or post-credential-compromise disruption rather than mass unauthenticated exploitation.

Signals are moderate and largely consistent rather than alarming. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with an availability-only impact (VA:H, VC:N/VI:N) describes a network-reachable but authenticated denial-of-service / device-brick condition, which aligns with CWE-190 (integer overflow) in the ipt_SAME.ko netfilter module and with the 'brick' reference title. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no POC flag was set in the input, so exploitation status is 'no public exploit identified at time of analysis' - although a third-party GitHub write-up (MeetFireAgain) is referenced, its contents and whether it includes working exploit code are not confirmed from the input. The practical risk is bounded by the PR:L requirement: an attacker must already be authenticated with rights to configure firewall/NAT rules, which substantially limits the exploit population to insiders or attackers who have already obtained credentials. Conflict/caveat to verify: the description states 'the attack may be launched remotely' and the vector is AV:N, but the root cause is a kernel module reached through firewall-rule configuration (same_check is the rule-check path), so 'remote' here means via the network-exposed management plane by an authenticated operator, not anonymous internet exploitation - verify management-plane exposure and user privilege model with MikroTik. Net: a real but medium-priority patch item (availability only, authenticated), not a critical unauthenticated RCE.

An attacker who already holds RouterOS credentials with firewall/NAT configuration rights connects to the device's network-exposed management interface (Winbox/API/SSH) and installs a crafted iptables SAME-target rule with manipulated range parameters. The same_check validation path in ipt_SAME.ko mis-handles the value, triggering an integer overflow that crashes or bricks the device. A GitHub write-up describing the brick is referenced, but no confirmed public exploit code is indicated in the input; the low attack complexity (AC:L) means the trigger is reliable once config access exists.