Live › vulnerability › CVE-2026-89035
Go to dashboardMikroTik RouterOS through 7.24.5 generates WebFig session tokens with fixed salts and does not bind them to the channel, so captured tokens can be replayed in new sessions. An attacker who steals a token keeps administrator access until the token store is cleared.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| RouterOS | vendor | <= 7.23.6, >= 7.24.0, <= 7.24.5 | – |
7.23.6 and earlier, or 7.24.0 through 7.24.5Until patched, disable WebFig or restrict it to a management network, and clear the token store.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.
This page as .md · .json · in your agent: get_signal("CVE-2026-89035")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.