MikroTik RouterOS: WebFig session token replay vulnerability (CVE-2026-89035)

MikroTik RouterOS versions through 7.24.5 are vulnerable to a session token replay attack within the WebFig interface. The vulnerability arises from the 'makeSessionKey' function in 'libucrypto.so', which generates session tokens using fixed, predictable salts. Because the implementation fails to incorporate session-specific or channel-specific input, tokens are not bound to the ECDH session used during initial authentication. Attackers who capture valid session tokens can replay them to bypass authentication and achieve administrative access. This access remains persistent until the router's internal token store is explicitly cleared. This finding builds upon the transport-layer weaknesses previously identified in CVE-2025-61481.

Impact

Successful exploitation allows for unauthorized administrative access to the affected MikroTik router. Attackers can maintain persistent control over the device and its configuration until the administrative session store is manually cleared.

Recommendation

• Inventory all internet-facing or sensitive management interfaces running MikroTik RouterOS 7.24.5 or older.
• Restrict access to the WebFig management interface to trusted management networks using firewall rules.
• Monitor for administrative account usage originating from unexpected source IP addresses or irregular timeframes.
• Verify the availability of firmware updates from MikroTik that address the 'makeSessionKey' implementation in 'libucrypto.so' and apply them as a priority.