AI analysis
RouterOS WebFig's /jsproxy handler contains an unauthenticated file-read flaw: a newly allocated session keeps a stale, uninitialized principal pointer that is later used to authorize file access (CWE-824), combined with a path-traversal issue (CWE-22). An unauthenticated attacker who can reach the web interface first shapes the heap allocator so the uninitialized pointer resolves with sufficient rights, then submits an encrypted URI containing parent-directory components to escape the WebFig file namespace. This lets the attacker read root-owned files on the router, including configuration stores that contain credentials, which could enable further compromise. Only MikroTik RouterOS 7.x before 7.23.4 (Long-term) and 7.24.2 (Stable) is affected. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation of this flaw is known (EPSS ~0.4%), although recent reporting notes MikroTik patches being chained in router-hijack campaigns generally.
What to do: Upgrade affected routers to RouterOS 7.23.4 (Long-term) or 7.24.2 (Stable). Until patched, restrict the www/WebFig service (and /jsproxy) to trusted management networks or VPN access and firewall WAN access to the router's web interface. Check logs for unauthenticated requests to /jsproxy containing traversal patterns, and rotate credentials found in router configuration stores if unexplained access is observed.
Affected
| MikroTik RouterOS (WebFig /jsproxy) | 7.x branch prior to 7.23.4 (Long-term) and 7.24.2 (Stable); fixed in 7.23.4 and 7.24.2 |
Estimated exposure
masson the order of 10^5-10^6 (likely hundreds of thousands) of internet-exposed MikroTik RouterOS devices, of which the vulnerable pre-fix 7.x subset with WebFig… — Public internet-wide scans have long shown on the order of a million MikroTik RouterOS devices with web/WinBox endpoints exposed, and only the 7.x pre-fix subset with /jsproxy reachable from untrusted networks is affected, so this is an…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable)