Webfig - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/webfig/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 13:45:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMikroTik RouterOS WebFig jsproxy Denial of Service (CVE-2026-84411)https://feed.craftedsignal.io/briefs/2026-11-mikrotik-routeros-jsproxy-overflow/Sun, 08 Nov 2026 13:45:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mikrotik-routeros-jsproxy-overflow/A pre-auth integer underflow in the MikroTik RouterOS WebFig /jsproxy endpoint allows unauthenticated attackers to cause a denial-of-service by triggering a crash of the www process.CVE-2026-84411 is a pre-auth integer underflow vulnerability in the MikroTik RouterOS WebFig interface's /jsproxy endpoint. The flaw is triggered when a specially crafted HTTP POST request with a 'Content-Type: msg' header is followed by a 'Content-Length' header that is smaller than the actual request body. Publicly available exploit modules demonstrate that this vulnerability can be leveraged to conduct denial-of-service (DoS) attacks by terminating the www process. No public weaponized RCE exploit is currently available, but the availability of reliable crash-mode PoC code increases the risk of service disruption.

Impact

The vulnerability results in a denial-of-service by crashing the web management service (www process) on affected MikroTik devices. This renders the WebFig interface unavailable until the service is manually recovered or the device is rebooted.

Recommendation

  • Upgrade RouterOS to version 7.23.6, 7.24.3, or later to address the vulnerable jsproxy handling.
  • Restrict access to the WebFig interface (typically port 80/443) to trusted management subnets via IP firewall filter rules.
  • Inventory all internet-exposed MikroTik routers and prioritize patching or isolating the management interface.
]]>highadvisorymikrotikrouteroswebfigdenial-of-servicevulnerability