attack vector is network; attack complexity is high; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is none.
Affected products
MikroTik RouterOS
Classified as
CWE-613 (Insufficient Session Expiration)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
MikroTik
RouterOS
Subsystems
Industrial Networking & Connectivity
Sectors
Multi-sector
What to Know
MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without incorporating channel-specific or session-specific input, and the user service validates tokens against the login store without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared. This vulnerability extends the impact of CVE-2025-61481, which identified the underlying transport-layer exposure without a corresponding fix. (NVD)
What to Do
Monitor MikroTik's web page for any future patch releases.