CVE-2026-67281: CWE-824 Access of uninitialized pointer in Mikrotik RouterOS
Description
CVE-2026-67281 is a high-severity unauthenticated file-read vulnerability in Mikrotik RouterOS WebFig 7.x branch. It arises from an uninitialized pointer used for file authorization in the /jsproxy path, allowing attackers to escape the WebFig file namespace and access root-owned files, including sensitive configuration stores with credentials. The issue was fixed in RouterOS versions 7.23.4 (Long-term) and 7.24.2 (Stable).
CVSS v4.0
Score 8.7high
Affected software
Mikrotik
RouterOS
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Mikrotik RouterOS WebFig involves an uninitialized principal pointer retained in a newly allocated session used for file authorization in the /jsproxy path. An unauthenticated attacker can manipulate the allocator so that the pointer is dereferenced with elevated rights, then use parent-directory components in an encrypted URI to escape the intended file namespace. This enables disclosure of root-owned files, including configuration files containing credentials. The flaw affects only the 7.x branch and was addressed in versions 7.23.4 and 7.24.2.
Potential Impact
An unauthenticated attacker can read arbitrary root-owned files on the affected RouterOS device, including sensitive configuration files that may contain credentials. This can lead to unauthorized disclosure of critical information and potential further compromise of the device or network.
Mitigation Recommendations
The vulnerability is fixed in RouterOS versions 7.23.4 (Long-term) and 7.24.2 (Stable). Users should upgrade to these or later versions to remediate the issue. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CERT-PL
- Date Reserved
- 2026-07-29T11:59:30.538Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9c76bdacd9273b4957266f
Added to database: 09/05/2026, 20:08:29 UTC
Last enriched: 09/15/2026, 01:01:01 UTC
Last updated: 10/20/2026, 06:48:18 UTC
Views: 118
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.