MikroTik RouterOS WebFig Pre-Auth Integer Underflow Root RCE

#!/usr/bin/env bash
# check_cve_2026_84411.sh — MikroTik RouterOS CVE-2026-84411 checker
# Usage: bash check_cve_2026_84411.sh <router-ip> [ssh-user]
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

HOST="${1:?Usage: $0 <router-ip> [ssh-user]}"
USER="${2:-admin}"

echo "[*] Checking MikroTik RouterOS version on $HOST as $USER..."

# Grab version string via SSH
VERSION_RAW=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${USER}@${HOST}" \
  '/system resource print' 2>/dev/null | grep -i 'version:' | head -1) || {
  echo "UNKNOWN — could not connect to $HOST via SSH"
  exit 2
}

VERSION=$(echo "$VERSION_RAW" | sed -E 's/.*version:[[:space:]]*//' | sed -E 's/[[:space:]].*//' | tr -d '\r')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse RouterOS version from output"
  exit 2
fi

echo "[*] Detected RouterOS version: $VERSION"

# Parse major.minor.patch
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)
PATCH=${PATCH:-0}

# Check if WebFig is enabled
WEBFIG=$(ssh -o ConnectTimeout=10 "${USER}@${HOST}" \
  '/ip service print where name=www' 2>/dev/null | grep -c 'disabled.*no') || WEBFIG=0

if [ "$WEBFIG" -gt 0 ]; then
  echo "[!] WebFig (HTTP) is ENABLED on this device"
else
  echo "[*] WebFig (HTTP) appears disabled (reduced exposure)"
fi

# Version comparison logic
# Fixed versions: 7.24.2, 7.23.4, 6.49.21
vulnerable=0

if [ "$MAJOR" -eq 7 ]; then
  if [ "$MINOR" -ge 25 ]; then
    vulnerable=0  # 7.25+ is safe
  elif [ "$MINOR" -eq 24 ] && [ "$PATCH" -ge 2 ]; then
    vulnerable=0  # 7.24.2+ is safe
  elif [ "$MINOR" -eq 23 ] && [ "$PATCH" -ge 4 ]; then
    vulnerable=0  # 7.23.4+ is safe
  else
    vulnerable=1
  fi
elif [ "$MAJOR" -eq 6 ]; then
  if [ "$MINOR" -gt 49 ]; then
    vulnerable=0
  elif [ "$MINOR" -eq 49 ] && [ "$PATCH" -ge 21 ]; then
    vulnerable=0  # 6.49.21+ is safe
  else
    vulnerable=1
  fi
else
  echo "UNKNOWN — unexpected major version $MAJOR"
  exit 2
fi

if [ "$vulnerable" -eq 1 ]; then
  echo "VULNERABLE — RouterOS $VERSION is affected by CVE-2026-84411"
  echo "  Fix: Update to 7.24.2 / 7.23.4 / 6.49.21"
  echo "  Immediate mitigation: Restrict or disable WebFig access"
  exit 1
else
  echo "PATCHED — RouterOS $VERSION is not affected by CVE-2026-84411"
  exit 0
fi