We verified the validity of CVE-2026-89035, a session token replay vulnerability in the WebFig interface of MikroTik RouterOS. The test confirmed that the token-based authentication mechanism does not bind the token to the specific ECDH channel, allowing an attacker to reuse a valid token on a new, independent session to bypass authentication and obtain full administrative privileges.
The test environment consisted of a CHR (Cloud Hosted Router) running RouterOS version 7.24.5 on QEMU/x86_64. The device was reachable at IP address 10.99.0.2 on port 80/tcp. The target service was the WebFig JsProxy protocol (/jsproxy), managed by the www process. The vulnerability is present in RouterOS versions <= 7.23.6 and from 7.24.0 to 7.24.5.
This content is reserved for those in the dojo.
Entry is free: you subscribe to the newsletter with your email and then choose to join the dojo, without a password. How it works
