CERT Polska is warning MikroTik customers to urgently update RouterOS after confirming that attackers are exploiting two critical SSH vulnerabilities to gain full administrative access to internet-exposed devices.
The Polish national cybersecurity team disclosed six RouterOS vulnerabilities on September 5, including two flaws it combined into an attack chain named MikroTrick. CERT Polska says it has observed exploitation since at least September 2 against devices exposing SSH to public networks.
MikroTik, a Latvian networking vendor whose RouterOS software is widely used in routers and wireless equipment, released fixes in 7.25beta3, 7.24.2, 7.23.4, and 6.49.21.
The first flaw, CVE-2026-67276 (CVSS 9.2), is an SSH authentication bypass caused by incomplete RSA public-key validation. An attacker who knows a username and the public modulus of that user's key can craft another key and authenticate without possessing the legitimate private key.
The second, CVE-2026-86060 (CVSS 9.2), stems from improper handling of specially crafted usernames. Exploiting it can elevate the resulting SSH session to full RouterOS administrator privileges.
CERT Polska confirmed that attackers are chaining the two vulnerabilities to take over exposed devices.
A third notable issue, CVE-2026-67277 (CVSS 8.8), affects the bandwidth-test service. An unauthenticated attacker can abuse protocol-state and validation flaws to leak kernel memory or remotely crash and restart a device.
The researchers also identified vulnerabilities affecting X.509 certificate handling, the SSH client, and the WebFig management interface.
Observed attacks left several useful indicators of compromise, including these log entries:
- login failure for user -2 from via ssh
- user added by ssh:-2@
CERT Polska also observed attackers creating a highly privileged account named “ops”. Successful attacks involving this account originated from 82.192.72.4, while 103.102.31.18 was seen attempting to exploit the chain.
The absence of these indicators does not prove that a device is clean.
After installing the update, RouterOS now scans for selected signs of unauthorized configuration changes and may mark affected devices as “Flagged”. Administrators can check this using /system/device-mode/print.
A Flagged device should be treated as potentially compromised, but a device without the marker may still have been breached.
CERT Polska said the vulnerabilities were discovered using an AI-assisted research environment involving OpenAI's GPT-5.5-cyber and GPT-5.6-sol models. The models helped automate version comparison, protocol analysis, binary analysis, and vulnerability testing, while researchers validated every finding on real RouterOS systems.
Administrators should update immediately and inspect devices for unknown users, scripts, scheduler tasks, proxies, tunnels, or other configuration changes. If compromise is suspected, CERT Polska recommends isolating the device, preserving logs and configuration, factory-resetting it, rebuilding from a trusted configuration, and rotating passwords, keys, and other secrets.
Until patching is possible, restrict access to SSH, WWW/WWW-SSL, and bandwidth-test services to trusted management networks.
Leave a Reply