Description
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Confidentiality (Vulnerable System)
High
Integrity (Vulnerable System)
None
Availability (Vulnerable System)
None
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- MikroTik / RouterOS7.24 – 7.24.2
- MikroTik / RouterOS7.0.0 – 7.23.4
- MikroTik / RouterOS6.0.0 – 6.49.21
- MikroTik / RouterOS7.20 – 7.23.4
- MikroTik / RouterOS7.20 – 7.23.4
References
- MISChttps://cert.pl/en/posts/2026/09/mikrotik-routeros-cve
- MISChttps://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
- MISChttps://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/
- MISChttps://mikrotik.com/supportsec/september-2026-vulnerability/
- MISChttps://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801
- MISChttps://forum.mikrotik.com/t/7-24-2-stable-is-released/272800
Updated 21m ago · 8 sources