{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/routeros--7.24.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2025-61481"},{"cvss":7.4,"id":"CVE-2026-89035"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["RouterOS (\u003c= 7.24.5)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","session-hijacking","network-security","cve-2026-89035"],"_cs_type":"advisory","_cs_vendors":["MikroTik"],"content_html":"\u003cp\u003eMikroTik RouterOS versions through 7.24.5 are vulnerable to a session token replay attack within the WebFig interface. The vulnerability arises from the 'makeSessionKey' function in 'libucrypto.so', which generates session tokens using fixed, predictable salts. Because the implementation fails to incorporate session-specific or channel-specific input, tokens are not bound to the ECDH session used during initial authentication. Attackers who capture valid session tokens can replay them to bypass authentication and achieve administrative access. This access remains persistent until the router's internal token store is explicitly cleared. This finding builds upon the transport-layer weaknesses previously identified in CVE-2025-61481.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized administrative access to the affected MikroTik router. Attackers can maintain persistent control over the device and its configuration until the administrative session store is manually cleared.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all internet-facing or sensitive management interfaces running MikroTik RouterOS 7.24.5 or older.\u003c/li\u003e\n\u003cli\u003eRestrict access to the WebFig management interface to trusted management networks using firewall rules.\u003c/li\u003e\n\u003cli\u003eMonitor for administrative account usage originating from unexpected source IP addresses or irregular timeframes.\u003c/li\u003e\n\u003cli\u003eVerify the availability of firmware updates from MikroTik that address the 'makeSessionKey' implementation in 'libucrypto.so' and apply them as a priority.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T19:57:56Z","date_published":"2026-10-21T19:57:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mikrotik-routeros-webfig-auth-bypass/","summary":"MikroTik RouterOS versions 7.24.5 and earlier contain a session token replay vulnerability in the WebFig interface that allows unauthenticated attackers to hijack administrative sessions.","title":"MikroTik RouterOS: WebFig session token replay vulnerability (CVE-2026-89035)","url":"https://feed.craftedsignal.io/briefs/2026-10-mikrotik-routeros-webfig-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - RouterOS (\u003c= 7.24.5)","version":"https://jsonfeed.org/version/1.1"}