MikroTik RouterOS CVE-2026-89035

Exploitation requires the WebFig management interface to be in use and reachable, and critically requires the attacker to have already captured a valid administrator session token - the flaw is token replay, not token forgery. The makeSessionKey function's use of fixed salts with no channel- or session-specific input, plus the user service's failure to verify channel context, are the specific defects that let a captured token be replayed across new ECDH sessions. Limiting factors: the attacker must obtain a token out-of-band (e.g., via the unfixed exposure of CVE-2025-61481), reflected by CVSS AC:H; no user interaction is needed once a token is held; and persistent access continues only until the device's token store is explicitly cleared, so clearing the login store is a direct mitigation. Devices with WebFig not exposed to untrusted networks are not realistically reachable.

This is a genuine high-priority issue for exposed WebFig management interfaces, but its real-world risk is materially gated by a precondition that the raw 9.1 score obscures. The provided CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) scores PR:N because replaying a stolen token bypasses authentication outright, yet it correctly assigns AC:H - the attacker must first capture a valid session token, which is not trivial from a network-only position. The underlying token-capture exposure comes from CVE-2025-61481 (transport-layer exposure that was never fixed), so exploitation realistically chains the two: this CVE is the authentication-bypass payoff once a token is obtained. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active exploitation or weaponization - status is 'no public exploit identified at time of analysis.' SSVC framing: technical impact is total (full administrative access), but automatability is constrained by the token-capture dependency, so this reads as a credible targeted-risk vulnerability rather than a mass-exploitation worm candidate. The 9.1/Critical rating is driven by the high confidentiality and integrity impact (full admin control) combined with network reachability; defenders should weight it as high but not treat it as drive-by-remote until a token-capture vector is confirmed reachable in their deployment.

An attacker who has captured a victim administrator's WebFig session token (for example by leveraging the unfixed transport-layer exposure of CVE-2025-61481) replays that token against a new ECDH session on the same RouterOS device. Because makeSessionKey uses fixed salts and the user service validates tokens without checking channel or session context, the replayed token is accepted and grants persistent administrative access that survives new sessions until the token store is manually cleared. No public exploit code was identified at time of analysis, and the CVSS AC:H reflects that the attacker must already possess a valid captured token.