The flaw occurs in the WebFig session handling of MikroTik RouterOS versions up to 7.24.5. The makeSessionKey routine constructs session tokens from a fixed salt that does not include any channel‑ or session‑specific data. Consequently the user service validates any token that matches the login store without checking the channel context, allowing an attacker to replay a captured token on a new ECDH session and obtain full administrative control until the token store is expressly cleared. This is an authentication bypass and provides a foothold for further compromise.

MikroTik RouterOS, versions 7.0 to 7.24.5, running the libucrypto.so component. The vulnerability is present in all routers that expose the WebFig interface and extends the exposure identified in CVE‑2025‑61481.

With a CVSS score of 9.1 the issue is deemed critical. While the EPSS score is not available, the lack of channel validation means an attacker can exploit the flaw remotely simply by intercepting a valid session token. The vulnerability is not yet listed in the CISA KEV catalog, but the impact and ease of exploitation make it a high‑priority target for attackers. The attack vector is remote over the network where WebFig is reachable; an attacker only needs to capture a legitimate session token and replay it on a new ECDH session to succeed.