CVE-2026-67281

CVE Enrichment

CVSS: 8.7 HIGH
EPSS: 0.73%
EPSS Percentile: 53.50%
CISA KEV: Not listed

Description

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 06-Sep-2026 03:17
Last Modified: 25-Sep-2026 21:21
EPSS Date: 2026-10-21
CWE: CWE-22, CWE-824

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:N /
                            VA:N /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

mikrotik / routeros Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 7.20 · before (exclusive) 7.23.4
cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*
mikrotik / routeros Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 7.24 · before (exclusive) 7.24.2
cpe:2.3:o:mikrotik:routeros:*:*:*:*:*:*:*:*

References

Last enrichment sync: 02-Nov-2026 03:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

(allows unauthenticated attackers to tamper with files, including configuration files), and CVE-2026-67281 (allows attackers to disclose root-owned files, including configuration stores). MikroTik Patches RouterOS Flaws Reportedly Chained to Take Over Routers

CVE (5)

Vendors (1)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.