EUVD-2026-72028
GHSA-m7q3-cwh2-ffg5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable WebFig default service, no auth required (PR:N), heap grooming is attacker-controlled so AC:L; impact is read-only credential disclosure (C:H, I:N, A:N).
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
4DescriptionCVE.org
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue was fixed in versions: 6.49.21 (Lont-term), 7.23.4 (Lont-term) and 7.24.2 (Stable)
AnalysisAI
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stores - to any network attacker who can reach the management interface. The vulnerability chains an uninitialized principal pointer (CWE-824) in /jsproxy session allocation with an encrypted URI path traversal, allowing pre-authentication escalation of file-read rights followed by namespace escape. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The WebFig management interface (HTTP TCP 80 or HTTPS TCP 443) must be reachable by the attacker; WebFig is enabled by default on all RouterOS installations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) accurately reflects the severity: the endpoint is network-reachable, requires no credentials, imposes no complexity barrier on the attacker, and yields high-confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade RouterOS immediately to 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable) per the MikroTik advisory at https://mikrotik.com/supportsec/september-2026-vulnerability/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all MikroTik RouterOS devices and verify firmware versions; isolate any running versions prior to 6.49.21 (LT), 7.23.4 (LT), or 7.24.2 (Stable) from untrusted networks and restrict WebFig access to trusted administrative IPs only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: k
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remot
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface.
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consu
MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /expo
Same weakness CWE-824 – Access of Uninitialized Pointer
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today