An integer underflow in HTTP request body handling has been identified in the RouterOS web management service (the service behind WebFig, listening on the www and www-ssl ports). A single specially crafted HTTP request, sent without logging in, could crash the service or allow an attacker to execute code on the router with full privileges. This issue has been assigned CVE-2026-84411 and is rated critical.
Discovery
Learnings
- auto_storiesStories
- categoryAreas
- helpFAQ
- forumConversations
- descriptionPapers
- mailNewsletters
- video_libraryVideos
- timelineTimeline
Guidance
- codeTechnology of APIs
- business_centerBusiness of APIs
- campaignEvangelism of APIs
- gavelGovernance of APIs
- historyHistory of APIs
- account_balancePolitics of APIs
Toolbox
- domainProviders
- apiAPIs
- cloudSolutions
- buildTools
- verifiedStandards
- gavelRegulations
- horizontal_ruleHeaders
- layersOverlays
- extensionExtensions
- schemaSchema
- policyPolicies
- ruleRules