<![CDATA[MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key]]>Two vulnerabilities in MikroTik RouterOS can be chained together to give attackers full administrative control of internet-exposed routers. The chain, dubbed MikroTrick by CERT Polska, allows compromise without a password, an SSH key, or even a completed authentication handshake.

The attack combines an SSH state-machine flaw tracked as CVE-2026-67279 with an argument-injection bug in the RouterOS login process tracked as CVE-2026-86060. Exploiting the two together bypasses the normal login flow entirely, granting administrative access to the device.

Key points:

  • Affected platform: MikroTik RouterOS devices with SSH exposed to the internet
  • Vulnerability 1: SSH state-machine flaw — CVE-2026-67279
  • Vulnerability 2: Argument-injection bug in the RouterOS login process — CVE-2026-86060
  • Impact: Full administrative takeover without credentials or a completed authentication step
  • Attack logs observed by researchers date back to at least [date truncated in source]

Because the chain does not require valid credentials, any router with SSH reachable from the internet should be treated as a potential target. Restricting SSH exposure to trusted networks and applying vendor fixes as they become available are the most direct mitigations.

Source: The Hacker News

Do you have MikroTik routers with SSH exposed to the internet, and if so, how are you securing them?

]]>https://xploitlk.com/topic/481/mikrotrick-chain-let-attackers-take-over-mikrotik-routers-without-a-password-or-ssh-keyRSS for NodeTue, 27 Oct 2026 10:37:38 GMTSun, 27 Sep 2026 06:30:25 GMT60