CVE-2026-67281: RouterOS WebFig File Read Vulnerability

CVE-2026-67281 Overview

CVE-2026-67281 is an unauthenticated file-read vulnerability in MikroTik RouterOS WebFig. The flaw lives in the /jsproxy request path, where a newly allocated session retains a stale, uninitialized principal pointer that is later consulted for file authorization. An unauthenticated attacker can shape the allocator state so this pointer resolves with sufficient rights, then supply parent-directory components inside an encrypted URI to escape the WebFig file namespace. The vulnerability is tracked as CWE-22 (Path Traversal) and affects only the 7.x branch. Fixes are available in RouterOS 7.23.4 (Long-term) and 7.24.2 (Stable).

Critical Impact
Unauthenticated remote attackers can read root-owned files, including configuration stores that hold device credentials.

Affected Products

MikroTik RouterOS 7.x branch prior to 7.23.4 (Long-term)
MikroTik RouterOS 7.x branch prior to 7.24.2 (Stable)
Devices exposing the WebFig HTTP/HTTPS interface with /jsproxy reachable

Discovery Timeline

2026-09-05 - CVE-2026-67281 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-67281

Vulnerability Analysis

RouterOS WebFig authenticates and authorizes file access using a principal object referenced from the active session structure. When a new session is allocated for a /jsproxy request, the principal pointer is not initialized before authorization runs. The session therefore inherits whatever object previously occupied that heap slot.

An attacker can prime the allocator with prior requests so the stale pointer resolves to an object with elevated file-serving rights. Once the authorization check passes, the request handler proceeds to serve a file identified by an encrypted URI supplied by the client. There is no session cookie, credential, or user interaction required.

Root Cause

The root cause is uninitialized-memory use in the WebFig session allocator combined with insufficient path sanitization in the file-serving routine. The session structure is not zeroed on allocation, so the principal pointer references stale heap contents. The file-serving path then trusts client-supplied URI components without normalizing parent-directory segments against the WebFig namespace boundary, mapping directly to CWE-22.

Attack Vector

Exploitation is fully remote and unauthenticated over the network-exposed WebFig interface. The attacker sends a sequence of /jsproxy requests to shape the allocator, then issues a crafted request whose encrypted URI contains .. traversal sequences. The handler resolves the traversal outside the WebFig root and returns arbitrary files owned by root, including the RouterOS configuration store containing user credentials and pre-shared keys. Refer to the NPratley analysis of the RouterOS 7.23.4 silent patch for a reverse-engineered walkthrough of the fix.

Detection Methods for CVE-2026-67281

Indicators of Compromise

Unauthenticated HTTP/HTTPS requests to the /jsproxy endpoint on RouterOS devices, especially in bursts consistent with heap grooming.
Successful /jsproxy responses returning file contents to clients that never completed WebFig login.
Unexpected outbound access to sensitive on-device paths such as configuration or credential stores.

Detection Strategies

Inspect web-server and firewall logs for repeated /jsproxy requests from a single source followed by anomalously large response bodies.
Alert on WebFig responses that deliver non-JavaScript content types to unauthenticated sessions.
Correlate WebFig access with subsequent authenticated logins from new source addresses, which may indicate use of leaked credentials.

Monitoring Recommendations

Restrict WebFig exposure to management networks and log all /jsproxy traffic at the perimeter.
Forward RouterOS logs to a centralized analytics platform to retain full request history for retrospective hunting.
Track the CERT.pl RouterOS advisory for updated indicators tied to active exploitation.

How to Mitigate CVE-2026-67281

Immediate Actions Required

Upgrade RouterOS 7.x devices to 7.23.4 (Long-term) or 7.24.2 (Stable) as documented in the MikroTik September 2026 vulnerability report.
Rotate all local RouterOS user credentials, RADIUS secrets, VPN pre-shared keys, and API tokens after patching, assuming disclosure.
Remove WebFig exposure from untrusted networks and block inbound HTTP/HTTPS to management interfaces at the perimeter.

Patch Information

MikroTik addressed the flaw in RouterOS 7.23.4 (Long-term) and 7.24.2 (Stable). Release details are published in the 7.23.4 release notes and 7.24.2 release notes. No fix is available for the 6.x branch because it is not affected. Additional context on the silent patch is available in the CERT.pl CVE advisory.

Workarounds

Disable the www and www-ssl services in RouterOS if WebFig is not required for administration.
Restrict WebFig to trusted source addresses using the RouterOS ip serviceaddress allow-list.
Front the WebFig interface with a VPN or jump host so /jsproxy cannot be reached by anonymous clients.

bash

# Configuration example: disable WebFig and restrict admin services to a management subnet
/ip service disable www,www-ssl
/ip service set winbox address=192.0.2.0/24
/ip service set ssh address=192.0.2.0/24