MikroTik RouterOS up to 7.23.6/7.24.5 WebFig libucrypto.so makeSessionKey authentication replay

Summaryinfo

A vulnerability categorized as critical has been discovered in MikroTik RouterOS up to 7.23.6/7.24.5. This vulnerability affects the function makeSessionKey of the file libucrypto.so of the component WebFig. Such manipulation leads to authentication replay. This vulnerability is uniquely identified as CVE-2026-89035. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in MikroTik RouterOS up to 7.23.6/7.24.5 and classified as critical. Affected by this issue is the function makeSessionKey of the file libucrypto.so of the component WebFig. The manipulation with an unknown input leads to a authentication replay vulnerability. Using CWE to declare the problem leads to CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). Impacted is confidentiality, integrity, and availability. CVE summarizes:

MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix.

The advisory is available at vulncheck.com. This vulnerability is handled as CVE-2026-89035 since 09/10/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/21/2026). This vulnerability is assigned to T1040 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Router Operating System

Vendor

• MikroTik

Name

• RouterOS

Version

• 7.23.0
• 7.23.1
• 7.23.2
• 7.23.3
• 7.23.4
• 7.23.5
• 7.23.6
• 7.24.0
• 7.24.1
• 7.24.2
• 7.24.3
• 7.24.4
• 7.24.5

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion