MikroTik RouterOS: Integer underflow in web management service enables pre-auth RCE

Summary

The web management service (WebFig, www and www-ssl) in affected MikroTik RouterOS versions contains an integer underflow in HTTP request body handling. An unauthenticated network attacker can send a single crafted request to execute arbitrary code as root or to cause a denial of service. The attacker only needs network reachability to the web interface; no credentials or user interaction are required.

Affected

• MikroTik RouterOS versions before 7.24 (per the CVE record and MikroTik's advisory)
• Vendor advisory lists v6 as affected as well; check the MikroTik security page for the exact v6 range
• Unknown: whether the range is exactly "up to 7.23" as stated by VulDB

Fixed in

• RouterOS v7 stable: 7.24
• RouterOS v7 long-term: 7.23.8
• RouterOS v6 stable/long-term: 6.49.23

Workaround

• Restrict the www and www-ssl services under IP > Services to trusted management addresses only.
• If the router is managed via WinBox or SSH, disable www and www-ssl.
• Keep the web management interface off the internet until patched.
• These are mitigations only; upgrading is the fix.

Exploitation

• CISA reports no known public exploitation of this vulnerability.
• BleepingComputer reported no publicly disclosed active exploitation at the time of publication.
• Public exploit code and reproduction repositories are reported on GitHub; their functionality is not verified.
• CISA SSVC: automatable yes, technical impact total.
• Not confirmed in the CISA Known Exploited Vulnerabilities catalogue.

Our recommendation

• Inventory all MikroTik devices, including branch and integrator-managed ones, and record the RouterOS version.
• Upgrade to a fixed build (7.24, 7.23.8 or 6.49.23) as soon as possible.
• Restrict or disable the www and www-ssl services, and never expose them on the WAN interface or via port forwarding.
• Check logs for unexpected HTTP requests to the router's web interface and for unknown configuration changes.
• Consider the risk higher if the web interface is reachable from untrusted networks; a compromised LAN host can still reach it.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (2 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  maxprog-svg/CVE-2026-84411 · Apiratchai/CVE-2026-84411-reproduction

Research sources

• CISA ICS Advisory ICSA-26-272-06 www.cisa.gov
• MikroTik Security Advisory CVE-2026-84411 mikrotik.com
• MikroTik Downloads mikrotik.com
• CISA CSAF JSON (GitHub) github.com
• Cycognito analysis www.cycognito.com
• BleepingComputer report www.bleepingcomputer.com
• Tenable CVE record www.tenable.com
• VulDB CVE-2026-84411 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:33.