{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/webfig/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mikrotik:routeros:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-84411"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["RouterOS (\u003c 7.23.6, 7.24.3)"],"_cs_severities":["high"],"_cs_tags":["mikrotik","routeros","webfig","denial-of-service","vulnerability"],"_cs_type":"advisory","_cs_vendors":["MikroTik"],"content_html":"\u003cp\u003eCVE-2026-84411 is a pre-auth integer underflow vulnerability in the MikroTik RouterOS WebFig interface's /jsproxy endpoint. The flaw is triggered when a specially crafted HTTP POST request with a 'Content-Type: msg' header is followed by a 'Content-Length' header that is smaller than the actual request body. Publicly available exploit modules demonstrate that this vulnerability can be leveraged to conduct denial-of-service (DoS) attacks by terminating the www process. No public weaponized RCE exploit is currently available, but the availability of reliable crash-mode PoC code increases the risk of service disruption.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in a denial-of-service by crashing the web management service (www process) on affected MikroTik devices. This renders the WebFig interface unavailable until the service is manually recovered or the device is rebooted.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade RouterOS to version 7.23.6, 7.24.3, or later to address the vulnerable jsproxy handling.\u003c/li\u003e\n\u003cli\u003eRestrict access to the WebFig interface (typically port 80/443) to trusted management subnets via IP firewall filter rules.\u003c/li\u003e\n\u003cli\u003eInventory all internet-exposed MikroTik routers and prioritize patching or isolating the management interface.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T13:45:03Z","date_published":"2026-11-08T13:45:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mikrotik-routeros-jsproxy-overflow/","summary":"A pre-auth integer underflow in the MikroTik RouterOS WebFig /jsproxy endpoint allows unauthenticated attackers to cause a denial-of-service by triggering a crash of the www process.","title":"MikroTik RouterOS WebFig jsproxy Denial of Service (CVE-2026-84411)","url":"https://feed.craftedsignal.io/briefs/2026-11-mikrotik-routeros-jsproxy-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Webfig","version":"https://jsonfeed.org/version/1.1"}