{"id":"CVE-2026-89035","kind":"vulnerability","aliases":["CVE-2026-89035"],"related":[],"title":"MikroTik RouterOS WebFig: replayed session tokens grant persistent admin access","description":"MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.","summary":"MikroTik RouterOS through 7.24.5 generates WebFig session tokens with fixed salts and does not bind them to the channel, so captured tokens can be replayed in new sessions. An attacker who steals a token keeps administrator access until the token store is cleared.","severity":"critical","cvss":9.1,"epss":0.00274,"exploited":false,"exploited_at":null,"products":[{"name":"RouterOS","fixed":[],"affected":"<= 7.23.6, >= 7.24.0, <= 7.24.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","mikrotik","routeros","self-hosted","webfig"],"not_affected_if":["webfig-disabled"],"how_to_check":"Run /system resource print on the router and compare the version to the affected ranges: 7.23.6 and earlier, or 7.24.0 through 7.24.5.\nCheck whether WebFig is enabled under /ip service print (www and www-ssl).","fix":"Until patched, disable WebFig or restrict it to a management network, and clear the token store.","status":"open","published_at":"2026-10-21T18:17:30+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:33:05+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T22:33:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown: the sources give no fixed version. Check MikroTik's RouterOS release notes for a build newer than 7.24.5 and the 7.23 branch fix.\nUntil patched, disable WebFig or restrict it to a management network, and clear the token store.","reach":"network","title":"MikroTik RouterOS WebFig: replayed session tokens grant persistent admin access","impact":"high","summary":"MikroTik RouterOS through 7.24.5 generates WebFig session tokens with fixed salts and does not bind them to the channel, so captured tokens can be replayed in new sessions. An attacker who steals a token keeps administrator access until the token store is cleared.","category":"infrastructure","who_cares":["mikrotik","routeros","self-hosted","webfig"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker gains persistent administrator control of the router","analyst_note":"Find the first fixed RouterOS build for the 7.23 and 7.24 branches in MikroTik release notes, and confirm whether WebFig is on by default.","how_to_check":"Run /system resource print on the router and compare the version to the affected ranges: 7.23.6 and earlier, or 7.24.0 through 7.24.5.\nCheck whether WebFig is enabled under /ip service print (www and www-ssl).","needs_analyst":true,"not_affected_if":["webfig-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000945,"input_tokens":3100,"output_tokens":1270,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory and a fixed RouterOS version, and confirm whether WebFig must be reachable from the internet; the NVD entry has no fix details.","search":"'-2025':153C '-2026':12A,15A '-61481':154C '-89035':13A,16A '7.24.5':28B,71C 'access':10A,61B,138C 'across':93C 'admin':9A 'administr':60B,137C 'allow':83C 'attack':54B,84C 'authent':87C 'bind':39B 'bypass':86C 'captur':45B,90C 'channel':43B,110C,129C 'channel-specif':109C 'clear':67B,145C 'contain':72C 'context':130C 'correspond':165C 'cve':11A,14A,152C 'ecdh':95C 'enabl':131C 'explicit':144C 'exposur':162C 'extend':148C 'fix':34B,105C,166C 'function':99C 'generat':29B,102C 'grant':7A,135C 'host':23B 'identifi':156C 'impact':150C 'incorpor':108C 'infrastructur':18B 'input':116C 'interfac':81C 'keep':59B 'layer':161C 'libucrypto.so':101C 'login':125C 'makesessionkey':98C 'mikrotik':1A,19B,25B,68C 'new':51B,94C 'persist':8A,136C 'replay':4A,49B,76C,89C 'routero':2A,20B,26B,69C 'routeros':17A 'salt':35B,106C 'self':22B 'self-host':21B 'servic':120C 'session':5A,31B,52B,74C,91C,96C,114C 'session-specif':113C 'specif':111C,115C 'steal':56B 'stolen':132C 'store':65B,126C,142C 'token':6A,32B,46B,58B,64B,75C,92C,103C,122C,133C,141C 'transport':160C 'transport-lay':159C 'under':158C 'use':104C 'user':119C 'valid':121C 'verifi':128C 'vulner':77C,147C 'webfig':3A,24B,30B,80C 'without':107C,127C,163C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-89035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89035","severity":null,"published_at":"2026-10-21T18:17:30+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-89035:226","url":null,"severity":null,"published_at":"2026-10-23T22:27:37+00:00","modified_at":"2026-10-23T22:27:37+00:00","first_seen_at":"2026-10-23T22:27:37+00:00","fetched_at":"2026-10-23T22:27:37+00:00","note":"No MikroTik advisory for this CVE found (supportsec lists none). Affected ranges from VulnCheck (credit Chocapikk) and Dojo lab (reproduced on CHR 7.24.5). Dojo lab says fixed in 7.24.6 and 7.23.7, but Dojo's own advisory page says no stable fix, and I could not confirm either in MikroTik changelogs; stable is now 7.25 per upgrade.mikrotik.com. Fix version is therefore unverified. No exploitation or public exploit seen (Noroxi/EPSS 0.27%); a lab repro exists, no code link."},{"source":"epss","external_id":"CVE-2026-89035","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89035","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1451,"url":"https://www.vulncheck.com/advisories/mikrotik-routeros-webfig-session-token-replay-authentication-bypass","title":"VulnCheck: RouterOS WebFig session token replay","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1452,"url":"https://mikrotikdojo.com/en/lab/cve-2026-89035-webfig-session-token-replay-routeros-lab/","title":"MikroTik Dojo lab: CVE-2026-89035 reproduced on 7.24.5","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}