MikroTik RouterOS CVE-2026-67281

The WebFig management interface (HTTP TCP 80 or HTTPS TCP 443) must be reachable by the attacker; WebFig is enabled by default on all RouterOS installations. No authentication is required - the vulnerability exists entirely in the pre-authentication session setup path before any credential check. No non-default configuration is needed. Heap grooming requires the ability to send multiple sequential HTTP requests to WebFig, which is trivially achievable over any routable path to the management port. The primary limiting factor is network segmentation: devices where WebFig is firewalled to a dedicated management VLAN or source-IP-restricted are not reachable from untrusted networks, reducing exposure to insider-threat or adjacent-network scenarios only. MikroTik hardening guides recommend such restriction but it is not enforced by default.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) accurately reflects the severity: the endpoint is network-reachable, requires no credentials, imposes no complexity barrier on the attacker, and yields high-confidentiality impact. Heap grooming is attacker-controlled and does not constitute a genuine complexity barrier in CVSS terms. Real-world risk substantially exceeds the raw score because credential disclosure from RouterOS config stores converts directly into full device compromise and lateral movement into all networks managed by the affected router - effectively amplifying a file-read into an RCE-equivalent outcome. Compound risk factors: a public exploit exists (documented via reverse-engineering of the silent patch in RouterOS 7.23.4), CERT-PL reported this alongside a post explicitly titled 'actively exploited' for the same RouterOS advisory cycle, and MikroTik routers are pervasive in ISP, SMB, and enterprise edge infrastructure with WebFig often left exposed on management interfaces. CISA KEV status is not confirmed in the input data, so formal active exploitation designation cannot be applied, but the CERT-PL signals are strong. No EPSS data provided. The gap between the 8.7 score and the actual blast radius (credential theft enabling full device takeover) means this should be treated with RCE-equivalent urgency.

An unauthenticated attacker sends a crafted burst of HTTP requests to the RouterOS WebFig /jsproxy endpoint to groom the allocator free-list, then triggers a new session allocation whose uninitialized principal pointer lands on a high-privilege authorization object. The attacker follows with a file-read request embedding encoded parent-directory traversal sequences in the encrypted URI, causing RouterOS to serve an arbitrary file - such as the admin credential database - outside the intended WebFig namespace. A public reverse-engineering writeup at https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/ documents the exploitation technique derived from patch diffing.