CVE-2026-67281

RouterOS WebFig's /jsproxy handler contains an unauthenticated file-read flaw: a newly allocated session keeps a stale, uninitialized principal pointer that is later used to authorize file access (CWE-824), combined with a path-traversal issue (CWE-22). An unauthenticated attacker who can reach the web interface first shapes the heap allocator so the uninitialized pointer resolves with sufficient rights, then submits an encrypted URI containing parent-directory components to escape the WebFig file namespace. This lets the attacker read root-owned files on the router, including configuration stores that contain credentials, which could enable further compromise. Only MikroTik RouterOS 7.x before 7.23.4 (Long-term) and 7.24.2 (Stable) is affected. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation of this flaw is known (EPSS ~0.4%), although recent reporting notes MikroTik patches being chained in router-hijack campaigns generally.

What to do: Upgrade affected routers to RouterOS 7.23.4 (Long-term) or 7.24.2 (Stable). Until patched, restrict the www/WebFig service (and /jsproxy) to trusted management networks or VPN access and firewall WAN access to the router's web interface. Check logs for unauthenticated requests to /jsproxy containing traversal patterns, and rotate credentials found in router configuration stores if unexplained access is observed.