CVE-2026-67281

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2

Description WebFig contains an unauthenticated file-read issue in the '/jsproxy' endpoint. A newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can manipulate the allocator to cause the file-serving path to dereference this pointer with elevated rights. By supplying parent-directory components in an encrypted URI, the attacker can escape the WebFig file namespace and disclose root-owned files, such as configuration stores containing credentials.

Recommendations Update to version 6.49.21 (Long-term). Update to version 7.23.4 (Long-term). Update to version 7.24.2 (Stable).