An unauthenticated file-read vulnerability in Mikrotik RouterOS allows attackers to disclose sensitive configuration files and credentials, and it is confirmed to be actively exploited in the wild.

This flaw involves the access of an uninitialized pointer and path traversal within the /jsproxy path of the WebFig interface. An unauthenticated attacker can manipulate memory allocation to bypass file authorization and read arbitrary root-owned files.

The vulnerability carries a CVSS score of 8.7, reflecting a high risk of total system compromise. Successful exploitation enables attackers to extract configuration stores, including administrative credentials, which can lead to complete device takeover, lateral movement within the network, and long-term persistence.

Immediate Action: Update all affected RouterOS instances to version 7.24.2, 7.23.4, or 6.49.21 immediately.

Proactive Monitoring: Review system logs for the "Flagged" marker or unauthorized additions of users, scripts, and scheduler tasks. Investigate logs for login failures or anomalous activity originating from suspicious IP addresses.

Compensating Controls: Disable public access to the WebFig and SSH interfaces until patches are applied. Utilize firewall rules to restrict management interface access to trusted administrative subnets.

Public Exploit Available: Yes, a published proof-of-concept exists as described in the technical write-up by npratley.net.

Given the confirmed active exploitation and the critical nature of the disclosed credentials, this vulnerability poses an immediate and severe threat. Administrators must prioritize applying the vendor-provided patches. Furthermore, because exploitation has been observed in the wild, any device currently running vulnerable versions should be audited for signs of compromise, such as the presence of unknown user accounts or unauthorized configuration changes.