MikroTik RouterOS 7.20 < 7.23.4 / 7.24.x < 7.24.2 WebFig Unauthenticated File Read (CVE-2026-67281)

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 7.20 prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by an information disclosure vulnerability. RouterOS WebFig contains an unauthenticated file-read vulnerabilit...

CVE-2026-67281

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences th...

EUVD-2026-72028

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences th...

CVE-2026-67281 Unauthenticated file read in Mikrotik RouterOS

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences th...

CVE-2026-67281

MikroTik RouterOS WebFig is affected by an unauthenticated file-read vulnerability in the /jsproxy path. The root cause is a stale uninitialized principal pointer retained by a newly allocated session, which an attacker can exploit by preparing the allocator and supplying parent-directory compone...

PT-2026-86455

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2 Description WebFig contains an unauthenticated file-read issue in the '/jsproxy' endpoint. A newly allocated session retains a stale...

The vulnerability of the JSProxy web server on the RouterOS operating system of MikroTik routers allows a hacker to cause a service failure.

The vulnerability of the JSProxy web server on the RouterOS operating system of MikroTik devices relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending specially crafted HTTP reques...