CVE-2026-67281
Description
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)
How to fix
- mikrotik routeros7.23.4, 7.24.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mikrotik routeros | 7.20 ≤ v < 7.23.4, 7.24 ≤ v < 7.24.2 | 7.23.4, 7.24.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.