Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in MikroTik RouterOS's WebFig interface could allow unauthorized access to administrative functions by replaying captured session tokens, bypassing standard authentication. This issue stems from how session tokens are generated and validated, potentially granting persistent administrative control until the token store is cleared.
- Attackers can reuse stolen access tokens.
- Confirms risk of unauthorized administrative access.
- Assess exposure, prioritize relevant systems.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by capturing session tokens from the WebFig interface and replaying them to gain administrative access. This bypasses the need for valid credentials by reusing previously established session information. The vulnerability can grant persistent administrative control until the system's token store is cleared.
- Network access required.
- Replay captured session tokens.
- Persistent administrative access.
Live Threat
Current exploitation, exposure, and threat context
A session token replay vulnerability in MikroTik RouterOS's WebFig interface could allow unauthenticated attackers to bypass authentication. This occurs when captured session tokens are replayed across new ECDH sessions, as tokens are generated with fixed salts and not validated with channel context, potentially granting persistent administrative access until the token store is cleared.
- Administrative access to network devices.
- Replaying captured session tokens across sessions.
- Persistent administrative access when supported.
Operational Fix
Recommended remediation, mitigation, and detection steps
Network and security teams are likely responsible for addressing this vulnerability in MikroTik RouterOS, given its impact on the WebFig interface, which is often exposed for remote administration. The immediate priority is to identify all instances of the affected technology, confirm their reachability and business criticality, and then locate the accountable owner to plan remediation based on assessed risk.
- Identify affected devices and owners.
- Verify external reachability and impact.
- Plan remediation or mitigation actions.
