Full Report
Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at
Analysis Summary
# Vulnerability: MikroTrick - MikroTik RouterOS SSH Auth Bypass and Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-67279 (SSH State-Machine Flaw) and CVE-2026-86060 (Argument Injection)
- **CVSS Score:** 10.0 (Critical - *estimated based on CISA KEV and full remote unauthenticated takeover*)
- **CWE:** CWE-694 (Use of Multiple Proxies with Conflicting Configurations/States) and CWE-88 (Improper Neutralization of Argument Delimiters in a Command)
## Affected Systems
- **Products:** MikroTik RouterOS
- **Versions:**
- All versions prior to **6.49.21**
- All versions prior to **7.23.4**
- All versions prior to **7.24.2**
- **Configurations:** Systems with the SSH service enabled and exposed to untrusted networks (e.g., the public Internet).
## Vulnerability Description
**MikroTrick** is a vulnerability chain consisting of two distinct flaws:
1. **CVE-2026-67279:** A state-machine flaw in the SSH daemon. By initiating an SSH key renegotiation during the authentication phase, the server erroneously transitions to the command phase without verifying user identity.
2. **CVE-2026-86060:** An argument injection bug in the `/nova/bin/login` process. The SSH daemon passes the username to this binary as a command-line argument without sanitization. If an attacker provides a username such as `-2`, the login program treats it as a flag to read identity/privilege data from file descriptor 2 (the terminal), which the attacker controls.
Chaining these allows an unauthenticated attacker to inject a high-privilege administrative session into the RouterOS console.
## Exploitation
- **Status:** **Exploited in the wild.** Active exploitation was detected as early as September 2, 2026. Added to CISA KEV on September 10, 2026.
- **Complexity:** Medium (Requires specific timing for renegotiation and FD manipulation).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full access to router configuration, traffic, and stored data).
- **Integrity:** High (Ability to create new administrative accounts, modify firewall rules, and install persistence).
- **Availability:** High (Attacker can crash the SSH process or disable the device).
## Remediation
### Patches
Update to the following RouterOS versions or newer:
- **v6.49.21**
- **v7.23.4**
- **v7.24.2**
### Workarounds
- **Disable SSH:** If not required, disable the SSH service via `/ip service disable ssh`.
- **IP Restrictions:** Limit SSH access to specific trusted source IP addresses using firewall rules or the `address-list` feature in `/ip service`.
- **Change Default Port:** Moving SSH to a non-standard port may reduce automated scanning but does not fix the underlying flaw.
## Detection
### Indicators of Compromise (IoC)
- **Logs:** Look for failed login attempts for the user `-2` in the system logs.
- **Unauthorized Accounts:** Check for the presence of unexpected administrative users (e.g., an account named `ops`).
- **File Activity:** Look for the creation of unexpected diagnostic files or evidence of unauthorized data transfers to unknown IP addresses.
- **System Stability:** Frequent crashes of the SSH process (`/nova/bin/ssh`).
## References
- **Vendor Advisory:** hxxps[://]mikrotik[.]com/supportsec/september-2026-vulnerability/
- **Technical Analysis:** hxxps[://]cert[.]pl/en/posts/2026/09/mikrotrick-technical-analysis/
- **Security News:** hxxps[://]thehackernews[.]com/2026/09/mikrotrick-chain-let-attackers-take.html