CVE-2026-67281

Executive Summary

CVE-2026-67281 is an unauthenticated file-read vulnerability in the MikroTik RouterOS WebFig management interface, specifically within the /jsproxy path, caused by a newly allocated session retaining a stale uninitialized principal pointer used for file authorization. An unauthenticated remote attacker can manipulate allocator state so that the file-serving path dereferences this pointer with excessive privileges, then use parent-directory traversal components in an encrypted URI to escape the WebFig file namespace and read root-owned files, including configuration stores that may contain credentials. The flaw affects only the 7.x branch and was fixed in RouterOS 7.23.4 (Long-term) and 7.24.2 (Stable).

Technical Analysis

The vulnerability is a path traversal (CWE-22) class defect rooted in improper initialization of authorization state during session allocation inside the RouterOS WebFig HTTP service. The NVD description states that within the /jsproxy path, a newly allocated session retains a stale uninitialized principal pointer that is subsequently used for file authorization decisions. Because the pointer is not correctly initialized to an anonymous or unprivileged principal, the file-serving logic may dereference it as though it belonged to a session with sufficient rights to access files.

Two conditions are required for successful exploitation:

1. Allocator state preparation — The unauthenticated attacker must arrange heap/allocator state such that the stale pointer resolves to a value interpreted as holding sufficient authorization rights for file access. This is a memory-state precondition rather than an authentication bypass in the traditional sense; the authorization check is not skipped but is evaluated against attacker-influenced residual state.
2. Encrypted URI traversal — The file-serving path receives an encrypted URI. By embedding parent-directory components (e.g., .. traversal elements) within that encrypted URI, the attacker causes path resolution to escape the WebFig file namespace and reach files outside the intended web-root, including root-owned files.

The attack surface is the WebFig web management interface exposed on the device. No authentication is required (PR:N), no user interaction is needed (UI:N), and the attack is network-reachable (AV:N). The impact is strictly confidentiality (C:H, I:N, A:N) — arbitrary file disclosure, with the most sensitive target being configuration stores that may contain credentials. The encryption applied to the URI is a transport/encoding layer, not a security control protecting the traversal; the defect is that traversal components survive into filesystem path resolution.

The description does not disclose specific function names, memory layout addresses, allocator grooming primitives, or exact file paths beyond /jsproxy. Any deeper code-level reconstruction beyond the above would be speculative.

Exploitation Scenarios

No public exploit code is confirmed in the provided data (Exploit Code: NO), though a Public PoC status is indicated. The following attack chain is described at the vulnerability-class level and is strictly bounded by the NVD description.

1. Reconnaissance / target identification — The attacker identifies internet- or network-exposed MikroTik RouterOS devices running a 7.x release prior to 7.23.4/7.24.2 with the WebFig interface reachable. Identification can be performed via fingerprinting of the WebFig login/asset endpoints or via internet-wide scanning using product/title fingerprints.

2. Triggering the flaw class — The attacker sends requests to the /jsproxy path to induce creation of a new session. The session's authorization state is populated from a stale, uninitialized principal pointer rather than being reset to an unauthenticated principal. The attacker sequences requests/grooms allocator state so that the residual pointer is interpreted as having sufficient file-access rights.

3. Traversal payload construction — The attacker supplies a crafted encrypted URI containing parent-directory components (..). Because path resolution does not properly confine the resulting path to the WebFig namespace, the traversal escapes the web-root and reaches root-owned files. The payload is delivered within the URI encoding expected by the /jsproxy file-serving path; the specific encryption scheme and parameters are not described in the available data.

4. Post-exploitation impact — The attacker reads arbitrary root-owned files readable by the file-serving process, most critically configuration stores that may contain credentials. Disclosed credentials can enable lateral movement, privilege escalation to full device compromise (router/switch/firewall control), and persistence. The flaw yields no direct code execution or file modification per the CVSS impact vector.

Caveat: No public PoC details are available in the provided intelligence; the exact allocator grooming sequence and URI encryption handling are inferred from the vulnerability class and the NVD description only.

Impact Assessment

This is a high-confidentiality, network-reachable, unauthenticated information-disclosure vulnerability with a CVSS base score of 7.5 (High).

• Attack Vector (AV:N) — Exploitable remotely across a network; no adjacent or local access required.
• Attack Complexity (AC:L) — Rated Low; despite the allocator-preparation step described, the CVSS assessment treats exploitation as repeatable without specialized conditions.
• Privileges Required (PR:N) — No authentication needed; any host that can reach WebFig can attempt exploitation.
• User Interaction (UI:N) — No victim action required.
• Scope (S:U) — Impact confined to the vulnerable component's security authority.
• Confidentiality (C:H) — High. Disclosure of root-owned files, including credential-bearing configuration stores.
• Integrity (I:N) / Availability (A:N) — None per the score.

Blast radius: Every RouterOS 7.x deployment exposing WebFig and below the fixed versions. Because RouterOS powers edge routers, firewalls, switches, and wireless infrastructure, a single disclosed credential store can compromise an entire network segment. Credential disclosure enables follow-on authentication to management interfaces, VPNs, and potentially downstream systems, making this an effective initial-access vector for enterprise and ISP environments. EPSS is 0.00612 (47.1st percentile), indicating low near-term predicted exploitation relative to all CVEs, but the public PoC status and edge-device targeting economics warrant immediate triage. CISA KEV status: not listed at the time of writing.

Detection Guidance

Sigma Rule

title: MikroTik RouterOS WebFig jsproxy Unauthenticated File-Read Attempt (CVE-2026-67281)
id: 4f9c2e7a-1b6d-4a83-9c21-7d5e0a9b3c14
status: experimental
description: Detects HTTP requests to the RouterOS WebFig /jsproxy path containing parent-directory traversal sequences in the URI, indicative of CVE-2026-67281 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-67281
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: '/jsproxy'
  selection_traversal:
    cs-uri-query|contains:
      - '..%2f'
      - '../'
      - '..%5c'
      - '%2e%2e%2f'
      - '%2e%2e/'
  condition: selection_path and selection_traversal
falsepositives:
  - Legitimate WebFig asset requests that encode relative paths (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.67281

YARA Rule

rule CVE_2026_67281_RouterOS_WebFig_Traversal
{
    meta:
        description = "Detects HTTP request artifacts targeting RouterOS WebFig /jsproxy with traversal (CVE-2026-67281)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-67281"
        date = "2026-01-01"
        severity = "high"

    strings:
        $jsproxy = "/jsproxy" ascii nocase
        $trav1 = "../" ascii
        $trav2 = "..%2f" ascii nocase
        $trav3 = "..%5c" ascii nocase
        $trav4 = "%2e%2e%2f" ascii nocase

    condition:
        $jsproxy and any of ($trav*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-67281 MikroTik RouterOS WebFig /jsproxy Traversal File-Read Attempt"; flow:established,to_server; http.uri; content:"/jsproxy"; http.uri; nocase; http.uri; content:".."; http.uri; pcre:"/(\.\.|%2e%2e)(\/|%2f|\\|%5c)/i"; classtype:attempted-recon; reference:cve,2026-67281; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-67281; sid:202667281; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      http.request.method == "GET" and
      url.path : "/jsproxy*" ]
  [ network where network.protocol == "http" and
      url.path : "/jsproxy*" and
      ( url.query : "*../*" or url.query : "*%2e%2e*" or url.query : "*..%2f*" ) ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=bluecoat:proxysg:access:syslog
| eval uri = coalesce(uri, cs_uri_stem, url)
| eval qs  = coalesce(uri_query, cs_uri_query, url_query)
| where match(uri, "(?i)/jsproxy")
| where match(qs, "(?i)(\.\.|%2e%2e)(/|%2f|\\\\|%5c)") OR match(uri, "(?i)(\.\.|%2e%2e)(/|%2f)")
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as clients by uri, qs, host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,mikrotik,cve-2026-67281,">
  <rule id="100672" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <regex>/jsproxy.*(\.\.|%2e%2e)(/|%2f|\\|%5c)</regex>
    <description>CVE-2026-67281: RouterOS WebFig /jsproxy path traversal file-read attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_67281,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Restrict network access to the WebFig management interface. Firewall management ports so that only trusted administrative networks or VPNs can reach them; never expose WebFig to the public internet.
• Disable or restrict the WebFig service on devices where it is not required, using RouterOS IP → Services configuration to limit address scope or disable the web service.
• Where WebFig must remain enabled, enforce source-address allowlisting and require management access over an encrypted, authenticated tunnel.
• Treat the device configuration as potentially compromised if traversal attempts are observed; rotate any credentials stored in device configuration stores.

2) Patch / upgrade steps

• Upgrade RouterOS to 7.23.4 (Long-term) or 7.24.2 (Stable) — the versions in which MikroTik fixed this issue for the 7.x branch.
• Verify the running version via the device's system resource/identity information before and after upgrade.
• Because no vendor fix confirmation was present in tracked patch sources at analysis time, validate the release notes for the target build prior to scheduled deployment and confirm the WebFig /jsproxy change is included.

3) Long-term hardening

• Adopt a management-plane isolation architecture: dedicated out-of-band or management VLANs for all network device administration.
• Enforce least privilege on device accounts and eliminate shared/static credentials across devices.
• Monitor edge-device configuration integrity and establish alerting for anomalous access to WebFig endpoints.
• Track MikroTik RouterOS security advisories and subscribe to release channels (Long-term and Stable) for proactive patching.
• Enable centralized logging of all management-interface access and retain logs for forensic reconstruction of traversal attempts.

References

• NVD — CVE-2026-67281: https://nvd.nist.gov/vuln/detail/CVE-2026-67281
• MikroTik RouterOS download / changelog (fixed versions 7.23.4 Long-term, 7.24.2 Stable): https://mikrotik.com/download
• MikroTik Security Advisories: https://mikrotik.com/support
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / in-the-wild note: No confirmed exploit-in-the-wild evidence and no CISA KEV listing were present in the provided intelligence. A public PoC status is indicated, but no exploit code was confirmed available in the source data. EPSS is 0.00612 (47.1st percentile). Monitor edge-device telemetry closely given the value of RouterOS credential disclosure to initial-access actors.