MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key
-
Two vulnerabilities in MikroTik RouterOS can be chained together to give attackers full administrative control of internet-exposed routers. The chain, dubbed MikroTrick by CERT Polska, allows compromise without a password, an SSH key, or even a completed authentication handshake.
The attack combines an SSH state-machine flaw tracked as CVE-2026-67279 with an argument-injection bug in the RouterOS login process tracked as CVE-2026-86060. Exploiting the two together bypasses the normal login flow entirely, granting administrative access to the device.
Key points:
- Affected platform: MikroTik RouterOS devices with SSH exposed to the internet
- Vulnerability 1: SSH state-machine flaw — CVE-2026-67279
- Vulnerability 2: Argument-injection bug in the RouterOS login process — CVE-2026-86060
- Impact: Full administrative takeover without credentials or a completed authentication step
- Attack logs observed by researchers date back to at least [date truncated in source]
Because the chain does not require valid credentials, any router with SSH reachable from the internet should be treated as a potential target. Restricting SSH exposure to trusted networks and applying vendor fixes as they become available are the most direct mitigations.
Source: The Hacker News
Do you have MikroTik routers with SSH exposed to the internet, and if so, how are you securing them?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login