MikroTik RouterOS EUVD-2026-91836

Exploitation requires that the RouterOS web management service (WebFig/HTTP admin interface) be network-reachable by the attacker; the flaw is in that service's HTTP request-body parsing and is reachable BEFORE authentication, so no credentials, user interaction, or special privileges are needed against a vulnerable version (RouterOS < 7.24). The primary limiting factor is exposure of the web management interface: devices that restrict or firewall the HTTP/WebFig service to trusted management networks, disable it, or have already upgraded to 7.24+ are not exploitable. No non-default feature toggle is implied by the description - the web management service is a standard RouterOS component - so the main realistic constraint is network reachability of that service.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes the worst-case profile for a network service: remote, low-complexity, no privileges, and no user interaction required, with full high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) - consistent with the description's claim of pre-authentication arbitrary code execution as root from a single crafted request. All signals align here: the attack vector in the CVSS record matches the description's 'unauthenticated network attacker' narrative (no network-vs-local conflict to reconcile). However, several exploitation-maturity signals are MISSING rather than negative: there is no EPSS probability provided, no CISA KEV listing in the input, and no POC indicator, so this analysis cannot claim active exploitation. The vulnerability was reported by CISA ICS-CERT (icscert) and carries an official ICS advisory, which elevates its credibility and suggests OT/critical-infrastructure relevance, but ICS-CERT coordination is not the same as confirmed in-the-wild exploitation. Net assessment: treat as urgent-to-patch due to pre-auth root RCE on a widely deployed network edge device, while explicitly noting that exploitation probability (EPSS) and real-world exploitation status (KEV) are unknown from the provided data.

An attacker locates a MikroTik RouterOS device (running a version below 7.24) whose WebFig/web management service is reachable over the network, then sends a single crafted HTTP request with a malformed body that triggers an integer underflow in the request-body handling path before any authentication occurs. The resulting memory corruption is leveraged to execute arbitrary code as root, giving full control of the router, or alternatively to crash the service for denial of service. No public exploit was identified at time of analysis, but the low attack complexity and single-request nature make reliable exploitation plausible once details are reverse-engineered from the patch.