CVE-2026-22114 Details
Description
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.
A vulnerability exists in MikroTik RouterOS due to HTTP basic authentication not enforcing a retry limit or backoff. This issue, combined with the default service password, makes it possible to exhaust the keyspace. The vulnerability is part of a broader set of issues referred to as 'MikroTrick', which includes active exploitation of SSH vulnerabilities on publicly accessible routers.
Users are advised to upgrade RouterOS to version 6.49.21, 7.23.4, 7.24.2 or 7.25 beta 3, all of which include the necessary fix. After upgrading, check the RouterOS log for signs of compromise and review the router's configuration for any unauthorized changes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://csirt.divd.nl/CVE-2026-22114 | [email protected] | Broken Link |
| https://csirt.divd.nl/DIVD-2026-00012 | [email protected] | BundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HTTP basic auth | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |