RouterOS WebFig contains an unauthenticated file‑read flaw in the /jsproxy endpoint. A newly allocated session retains a stale, uninitialized principal pointer used for file authorization. An attacker can manipulate the memory allocator so that this pointer is dereferenced with sufficient rights and provide parent‑directory components in an encrypted URI to escape the WebFig file namespace, allowing the disclosure of root‑owned files—most notably configuration stores that contain credentials. This weakness corresponds to CWE‑22 (Path Traversal) and CWE‑824 (Stale Pointer).

The vulnerability affects Mikrotik RouterOS in the 7.x branch. Any 7.x build prior to 7.23.4 in the long‑term release and prior to 7.24.2 in the stable release is vulnerable. Devices running those earlier revisions expose the WebFig interface on the router and are susceptible to the file‑read issue.

The CVSS score of 8.7 categorizes this as high severity. The EPSS score is below 1%, indicating a low but non‑zero probability of exploitation in the wild, and the flaw is not yet listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated attacker sending a specially crafted /jsproxy request over HTTP or HTTPS to the router’s WebFig service; no authentication is required. If an adversary can reach WebFig from the network, they can read arbitrary high‑privilege files, compromising the router’s confidentiality and configuration integrity.