WebFig Vulnerability: Session Token Replay

What is the CVE-2026-89035 vulnerability?

CVE-2026-89035 is a session token replay vulnerability in the WebFig interface that allows bypassing authentication by reusing captured tokens in new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel- or session-specific input, and the user service validates tokens against the login store without verifying the channel context. This allows stolen tokens to grant persistent administrative access until the token store is explicitly cleared. The vulnerability extends the impact of CVE-2025-61481, which had identified transport-level exposure without a corresponding fix.

Which RouterOS versions are vulnerable?

The vulnerable versions are all those up to 7.23.6 and up to 7.24.5. The fixed version has not yet been announced.

Is my router at risk?

A router is at risk if the WebFig service is active and reachable from untrusted networks. If you do not use WebFig, the www service should be disabled. If you do use it, it must be reachable only from the trusted administration network.

Is the CVE-2026-89035 vulnerability actively exploited?

As of the date of this article, it is not reported as exploited. CISA does not include it in the KEV catalog, and ENISA does not report it as exploited.

How to protect the router from CVE-2026-89035?

Since a stable fixed version is not yet available, the primary mitigation consists of restricting access to the WebFig service. Disable the www service if you do not use it. If you do use it, ensure it is reachable only from the trusted administration network and not from external or untrusted networks. Monitor access logs for any anomalous authentication attempts.

Which RouterOS commands are needed to mitigate CVE-2026-89035?

Temporary mitigation: www service

The defect concerns the web management service (WebFig). If you do not use it, disable it; if you do use it, it must be reachable only from the administration network.

# quali servizi di gestione sono attivi e da dove sono raggiungibili
/ip service print
# se WebFig non serve: spegnilo
/ip service set www disabled=yes
/ip service set www-ssl disabled=yes
# se serve: limitalo alla rete di gestione (sostituisci con la tua)
/ip service set www address=192.168.88.0/24
/ip service set www-ssl address=192.168.88.0/24

Update RouterOS

The only definitive fix is an update. First, save the configuration; the installation restarts the router.

# 1. salva configurazione e backup
/export file=prima-aggiornamento
/system backup save name=prima-aggiornamento
# 2. scegli il canale (long-term o stable) e controlla la versione disponibile
/system package update set channel=stable
/system package update check-for-updates
# 3. installa: ATTENZIONE, il router si riavvia
/system package update install
# 4. dopo il riavvio, aggiorna anche il firmware (RouterBOOT) e riavvia di nuovo
/system routerboard upgrade

Official sources

• https://www.vulncheck.com/advisories/mikrotik-routeros-webfig-session-token-replay-authentication-bypass