MikroTik RouterOS: Session token replay in WebFig allows authentication bypass
Summary
MikroTik RouterOS through 7.24.5 contains a session token replay flaw in the WebFig management interface. The token generation uses fixed salts and the user service does not check the channel context, so captured session tokens can be replayed in new sessions. A successful attacker gains persistent administrative access until the token store is explicitly cleared, and the attacker must first capture a valid token and have network access to the device.
Affected
- RouterOS up to and including 7.23.6
- RouterOS 7.24.0 through 7.24.5
Fixed in
Unknown. No vendor advisory or fixed version was found at the time of research.
Workaround
- Disable WebFig if it is not required.
- If WebFig is required, restrict it to a management VLAN or an IP allowlist and never expose it to the internet.
- Enforce HTTPS only for management access.
- Review admin logins and active sessions, and rotate admin passwords after any suspected exposure.
- The procedure to clear the token store is not documented in the sources found.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- EPSS 0% at the time of the source snapshot.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept found.
Our recommendation
- Inventory all RouterOS devices and their versions and flag affected versions.
- Check whether WebFig is reachable from the internet or from guest or user networks, and restrict or disable it.
- Enforce HTTPS and limit admin access to trusted management networks.
- Monitor MikroTik release notes and the VulnCheck advisory for a fixed version and confirmed steps to clear existing sessions.
- Re-check exploitation status (KEV, EPSS) regularly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Rapid7 vulnerability database entry www.rapid7.com
- GitHub inventory checker project github.com
- VulDB entry vuldb.com
- CVE Details for related CVE-2025-61481 www.cvedetails.com
- CIRCL vulnerability lookup for CVE-2025-61481 vulnerability.circl.lu
- Cyber Defence CVE summary www.cyber-defence.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:36.
Original description (NVD)
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.