MikroTik RouterOS flaw — how the attack unfolds.
Join free to unlock: how it works, a step-by-step setup with its costs, what you gain, and where it falls short, for every Friday idea.
The big picture
Picture the service hatch at the back of a shop, meant only for the maintenance contractor. Its latch is faulty: pushed the right way, it opens before anyone shows a badge. The router's web management page is that hatch, and this flaw is the faulty latch.
A router is the box that connects a business's own network to the internet. MikroTik routers run software called RouterOS, which includes a web page, WebFig, for managing the router from a browser. MikroTik's documentation lists it as two services: www for plain web and www-ssl for encrypted web.
Where the attack goes, from the internet into the business
The attacker comes in at the top and moves down. Red is the attack; each layer ends with the control that stops it.
Internet. Keep the router's web page off the internet. CISA's first advice: control devices should not be reachable from it.
Web page. WebFig, the router's web management page: the www and www-ssl services, so an admin can change settings from a browser. Takeover: an integer underflow in how the page reads the request, before login, runs the attacker's code (CVE-2026-84411). Update to RouterOS 7.24 or later. Until then, block the page from untrusted networks with a firewall rule.
Router. MikroTik router, RouterOS below 7.24: the box between the business network and the internet. Full control or a crash: remote code execution with root access, or a denial of service that stops the router. Check the update channel: the fix ships on stable. Long-term is still at 7.23, which CISA lists as affected.
Business network. Office, shop floor and staff connections: everything that reaches the internet through this router. Keep control systems behind firewalls and apart from business networks. Admins working remotely use a VPN, kept up to date.
The flaw: technical view
The attack, step by step
The same four steps as the exporter example in section 1, each explained in plain words. Steps 1 to 3 use the flaw as CISA describes it; step 4 follows MikroTik's update channels.
1. Find the door: the router's web page answers from the internet
- What a router is: the box that connects a business's own network to the internet. Every email, card payment and video call leaves and enters through it.
- The web page: RouterOS has a built-in page, WebFig, that lets an admin change the router's settings from a web browser. MikroTik lists it as two services, www and www-ssl.
- Where the risk is: the flaw is in that page. Anyone who can reach the page can try it, which is why CISA's first advice is to keep such devices off the internet.
- How a page ends up online: for example, a business opens it so an outside IT contractor can manage the router remotely. CISA advises a VPN for remote access instead.
- Everyday picture: a service hatch that faces the street. Normally only the contractor uses it, but anyone walking past can try the latch.
2. Get in: one request, before any password
- What a request is: when an admin opens the router's page, the browser sends the router a short message: what it wants, plus a body of data such as a filled-in form. The router reads the message before deciding who is allowed in.
- Where the flaw is: CISA says the router mishandles the body of that message through an integer underflow: a subtraction drops below the smallest number the program can hold, so the result comes out wrong.
- What the attacker gets: their own program running on the router as root, the account with full control. This is remote code execution with root access.
- Why it matters: all of this happens before any login. The attacker needs no password, no account and no help inside; CISA says one request is enough.
- Not published: the exact request. We know what the flaw allows, not the precise trick.
- Everyday picture: the hatch latch is meant to check a badge, but a parcel pushed through a certain way jams it open before the check starts.
3. Take control or knock out: the router does what the attacker says
- What full control means: root is the highest level of control on the router. Whoever has it can change any setting an admin can, including the router's firewall rules.
- Or a crash: CISA says the flaw can also cause a denial of service. The router stops working, and so does everything behind it that needs the internet.
- What the sources do not say: what an attacker would do next. No attack has been reported to CISA, and this paper does not guess beyond what full control means.
- Why it matters: the router is the one point every connection passes through. Losing control of it, or losing it altogether, affects the whole business, not one computer.
- Everyday picture: whoever gets through the hatch reaches the shop's main switchboard. They can change any switch, or turn everything off.
4. Stay exposed: the long-term update channel does not offer the fix
- What a channel is: RouterOS updates come in release channels. Long-term is released rarely and gets only the most critical fixes; stable comes every few months with all tested fixes and features.
- What the update check does: it looks for a newer version on the router's chosen channel only. The newest long-term release is 7.23.7; 7.24 has been on stable since August 2026.
- The open question: MikroTik called long-term 7.23.4 an important security update, with fixes to the web services, but published no details. CISA's later advisory still lists every version below 7.24 as affected.
- Why it matters: a router can be on the newest long-term release, look up to date, and still be counted as affected. Until MikroTik or CISA says otherwise, treat 7.23 as affected.
- Older routers: RouterOS 6 is below 7.24 too. MikroTik's guide says a version 6 router must first move to 7.12.1 through the Upgrade channel, then update again.
- Everyday picture: a recall notice sent only to buyers of this year's model. Owners of the older, steadier model hear nothing and assume their car is fine.
Why this is different from an ordinary software bug
| What the sources say | Why it matters |
|---|
| No login needed | The flaw is reached before the router asks for a password | Passwords do not protect against it; keeping the page out of reach does |
| Full control, not just a crash | Code runs as root; rated 9.8 out of 10 on the CVSS scale | 9.8 falls in the critical band, 9.0 and above, so it is worth updating promptly |
| Easy to repeat | CISA rates the attack as automatable | If the method becomes known, it could be tried on many routers at once |
| The fix is on one channel | 7.24 is on stable; long-term is at 7.23.7 | The usual update check can show no fix while the router is still affected |
On the long-term channel? The update check will not offer 7.24. Step 4 above explains why.
The flaw at a glance
| Item | Detail |
|---|
| Flaw | CVE-2026-84411: CWE-191, integer underflow |
| Where | Web management service, HTTP request body handling, before authentication |
| Affected | RouterOS below 7.24 |
| Fixed | 7.24 or later, on the stable channel; newest stable is 7.24.5 |
| Severity | CVSS v3.1 9.8 (critical), AV:N/AC:L/PR:N/UI:N; CVSS v4.0 9.3 |
| CISA SSVC | Exploitation: none. Automatable: yes |
| Reported | By an anonymous researcher, to CISA; no known public exploitation |