Is the DoS permanent?

Yes, the www service does not recover on its own. The process remains stuck in an infinite loop inside the memory allocator (100% CPU) and requires a system reboot to be restored.

Do the other services remain active during the attack?

Yes, SSH, WinBox, and other services continue to function. Only the www service (ports 80/443) is affected by the block.

Is version 7.23 completely secure?

Version 7.23 contains a guard that blocks the specific trigger on /jsproxy tested in the lab. However, the official MikroTik advisory states "fixed in 7.24", suggesting that other variants may exist. It is recommended to upgrade to 7.24 for full protection.

LabLab · CVE-2026-84411

CVE-2026-84411: Persistent DoS on RouterOS WebFig Reproduced in the Lab

Image generated locally with ComfyUI from randomly selected elements. How the images are created

We deterministically reproduced a persistent Denial of Service on the RouterOS WebFig service, caused by an integer underflow that hangs the www process. The issue is present in versions up to 7.22.3 and is resolved starting from version 7.23, with the complete fix recommended in 7.24.

by Gianni Olivieri | MikroTik Dojo Published on 14 October 2026 3 min read

The vulnerability is described in the article RouterOS 6.49.23 long-term: CVE-2026-84411 fix.

We tested vulnerability CVE-2026-84411, an integer underflow (CWE-191) in the www process serving RouterOS ports 80/443. The goal was to verify whether a single, appropriately crafted HTTP request, sent without authentication, could cause a heap overflow that puts the web service into a permanent wedge state, requiring a reboot to recover.

Reserved for members

This content is reserved for those in the dojo.

Entry is free: you subscribe to the newsletter with your email and then choose to join the dojo, without a password. How it works

Other articles

CVE-2018-14847: Recovering plaintext passwords from user.dat on RouterOS v6