9.1
Critical
CVE-2026-89035 MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows…
Description
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.
Affected products and versions
Other CVEs of RouterOS
The 26 CVEs of RouterOS →
CVE-2026-112158
A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8
7.1
High
CVE-2026-103903
An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote…
8.7
High
CVE-2026-84411
The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling…
9.8
Critical
CVE-2026-93345
MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI…
8.7
High