The vulnerability is an integer overflow in the same_check function of the ipt_SAME.ko kernel module. This overflow could corrupt internal counters, which may lead to a crash or loss of service. Although the advisory does not describe a code‑execution path, it is inferred from the nature of the flaw that the overflow could jeopardize the router’s availability and integrity.

MikroTik RouterOS firmware versions up to 6.40.5, 6.44, and 7.20.8 are affected. The flaw resides in the ipt_SAME.ko module shipped with these releases, so every device running an affected version is at risk unless the firmware has been updated.

The CVSS score of 7.1 places this flaw in the high severity range, indicating significant potential impact. The attack can be launched remotely, allowing an adversary to send a malicious packet without local privileges. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Based on the remote nature and high CVSS score, it is inferred that motivated attackers could exploit this weakness, especially if network traffic is not filtered for suspicious patterns.