Session Token Replay in MikroTik RouterOS WebFig

Executive Summary

MikroTik RouterOS through version 7.24.5 has a session token replay vulnerability in the WebFig interface. Attackers can bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function generates tokens using fixed salts without session-specific input, and the user service validates tokens without checking channel context. This allows stolen tokens to grant persistent administrative access until the token store is cleared.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking MikroTik RouterOS versions and monitoring for unauthorized administrative access via WebFig. Verify if your RouterOS version is 7.24.5 or earlier. Inspect logs for repeated authentication attempts or unexpected administrative sessions. Use RouterOS commands like /system package print to check versions and /log print to review authentication events.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized administrative access to a MikroTik router, potentially leading to network compromise, data theft, or disruption of services. Persistent access remains until tokens are manually cleared, increasing the risk of long-term exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected MikroTik devices may face compliance failures, potential fines, and reputational damage due to data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade RouterOS to a patched version beyond 7.24.5. Clear all active session tokens using /user clear-session. Disable WebFig access if not required. Restrict administrative access to trusted IP addresses and enable firewall rules to block unauthorized access attempts.

Useful 0 Not Useful 0