EUVD-2026-51258
GHSA-x9w7-jgwj-cp2f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
API is network-reachable but requires an active high-privilege authenticated session (PR:H); only confidentiality is impacted with no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.
AnalysisAI
Insufficient session expiration in the MikroTik RouterOS API allows authenticated users whose permissions have been reduced to retain their prior, elevated access rights for the duration of the stale session. Specifically, when a user's group membership or permission set is downgraded, or when an inactivity timeout is expected to expire a session, the RouterOS API fails to re-evaluate or invalidate the existing session token - exposing confidential routing, firewall, or credential data the user should no longer reach. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; however, ICS-CERT's publication of ICSA-26-211-01 signals elevated concern for operational technology networks where MikroTik devices are used for segmentation and industrial network management.
Technical ContextAI
The vulnerability resides in the RouterOS API session management layer - the programmatic interface (TCP/8728 plaintext, TCP/8729 TLS) used by administrators, automation scripts, and third-party management tools to interact with MikroTik networking devices. CWE-613 (Insufficient Session Expiration) describes a server-side failure to invalidate or re-evaluate session tokens when access conditions change: here the triggering events are either a user-group permission change or an inactivity timeout that should have terminated the session. The CPE string cpe:2.3:a:mikrotik:routeros:*:*:*:*:*:*:*:* carries no version bounds, indicating the flaw is assessed as systemic across the RouterOS product line rather than introduced in a specific release. The CVSS 4.0 vector confirms a purely confidentiality-impacting flaw (VC:H, VI:N, VA:N) with no downstream scope change, consistent with a session staleness issue that leaks data without allowing writes or service disruption.
RemediationAI
Consult CISA ICS-CERT advisory ICSA-26-211-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-01) for the vendor-supplied patch; a specific patched RouterOS version was not confirmed in available data at time of analysis, so monitoring that advisory for an updated fixed-version notice is the recommended first step. As an immediate compensating control, disable the RouterOS API entirely if it is not operationally required - navigate to IP > Services in RouterOS and set the API and API-SSL services to disabled; note this will break any automation or monitoring tools relying on the API port. If the API must remain enabled, enforce the shortest feasible session timeout in RouterOS API settings and establish an operational procedure to manually terminate active sessions (via '/ip service' or connected session management) immediately whenever a user's permissions are modified - do not rely on passive timeout expiration. Restrict API reachability via RouterOS firewall input-chain rules to explicitly allow only authorized management hosts on TCP/8728 and TCP/8729, dropping all other source addresses; this limits who can benefit from a stale session even if one exists. Prefer API-SSL (TCP/8729) over plaintext API to prevent credential and session-token interception on the wire.
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: k
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remot
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stor
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consu
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today