Full Report
Multiple vulnerabilities have been discovered in MikroTik Routers, the most severe of which could allow for admin hijacking. MikroTik routers are network devices that use the RouterOS operating system to provide advanced routing, firewall, wireless, VPN, bandwidth management, and network security features for homes, businesses, and internet service providers. Successful exploitation of the most severe of these vulnerabilities could allow an attacker to take full control of a device without authentication.
Analysis Summary
# Vulnerability: Multiple MikroTik RouterOS Administrative Hijacking Vulnerabilities
## CVE Details
- **CVE ID:** CVE-2026-67276
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-287 (Improper Authentication)
- **CVE ID:** CVE-2026-86060
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-269 (Improper Privilege Management)
- **CVE ID:** CVE-2026-67277
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-191 (Integer Underflow) / CWE-200 (Information Exposure)
## Affected Systems
- **Products:** MikroTik Routers
- **Versions:** RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.4, and 6.49.21.
- **Configurations:** Systems with SSH enabled and those running the bandwidth-test service.
## Vulnerability Description
Three distinct flaws enable administrative compromise and information leakage:
1. **SSH Authentication Bypass (CVE-2026-67276):** RouterOS incorrectly compared only the public modulus of a user’s RSA key rather than the full key. An attacker with knowledge of a username and its public modulus could craft a malicious key to gain unauthorized access.
2. **Username Logic Flaw (CVE-2026-86060):** Improper handling of SSH usernames starting with disallowed characters allowed attackers to bypass authentication and receive a session with full administrative privileges.
3. **Bandwidth-Test Service Flaw (CVE-2026-67277):** An unauthenticated connection could reach a privileged state. When combined with an integer underflow and uninitialized packet-buffer data, this allows for kernel memory leaks or Denial of Service (DoS) via device crashes.
## Exploitation
- **Status:** **Exploited in the wild.**
- **Complexity:** Low to Medium.
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Full access to device data and kernel memory).
- **Integrity:** High (Full administrative control over device configurations).
- **Availability:** High (Device can be crashed or hijacked).
## Remediation
### Patches
MikroTik has released updates to the stable channel. Administrators should update to at least:
- **RouterOS v7.24.2** (or v7.25beta3 for development branch)
- **RouterOS v7.23.4**
- **RouterOS v6.49.21**
### Workarounds
- Disable the SSH service if not required.
- Disable the bandwidth-test server if not in use.
- Use Firewall rules (ACLs) to restrict access to management services (SSH, Winbox) only to trusted IP addresses.
## Detection
- **Indicators of Compromise:** Unusual administrative logins in logs, specifically associated with SSH sessions; unexpected reboots; or unauthorized configuration changes.
- **Detection methods:** Automated vulnerability scans using SCAP-compliant tools; monitoring for SSH traffic from untrusted external IPs.
## References
- hxxps[:]//nvd[.]nist[.]gov/vuln/detail/CVE-2026-86060
- hxxps[:]//nvd[.]nist[.]gov/vuln/detail/CVE-2026-67276
- hxxps[:]//nvd[.]nist[.]gov/vuln/detail/CVE-2026-67277
- hxxps[:]//mikrotik[.]com/supportsec/september-2026-vulnerability/
- hxxps[:]//www[.]helpnetsecurity[.]com/2026/09/07/mikrotik-routeros-ssh-vulnerabilities-exploited/