CyberSecurity News
MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key
AI summary
Attackers can gain full administrative control of MikroTik routers exposed to the internet without needing a password, SSH key, or completed authentication. This is made possible by chaining two vulnerabilities in RouterOS SSH, specifically a state-machine flaw and an argument-injection bug in the login process. These vulnerabilities are referred to as MikroTrick by CERT Polska. The flaws are identified as CVE-2026-67279 and CVE-2026-86060. Attack logs indicate that exploitation of these vulnerabilities has been occurring.
Vulnerabilities mentioned
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.