DEV Community

yutianle
yutianle

Posted on

MikroTrick, Part One: How CVE-2026-67277 Breaks RouterOS Authentication

#security #vulnerability #mikrotik #routeros

MikroTrick, Part One: How CVE-2026-67277 Breaks RouterOS Authentication

A router that authenticates nobody is not a router. It is a doorway, and in early September 2026 attackers walked through one that MikroTik left ajar. CVE-2026-67277 is a missing-authentication flaw in MikroTik RouterOS, and CERT Polska has confirmed it is being used against internet-facing devices right now. This piece examines the flaw itself: what class of defect it is, what an attacker needs to reach it, and why the failure is structural rather than cosmetic.

Vulnerability overview

CVE-2026-67277 is classified as CWE-306, Missing Authentication for Critical Function. In plain terms, a function that should require a caller to prove who they are does not check. The affected function is part of the RouterOS management surface reachable over SSH. CERT Polska published its warning on 2026-09-05 after observing exploitation that began on 2026-09-02, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-09-10. Public reporting places the CVSS severity around 9.2, and CISA treats it as critical.

The CVE does not travel alone. It is the first half of an exploit chain that researchers and CERT Polska call MikroTrick, which pairs it with CVE-2026-86060, a CWE-88 argument-delimiter neutralization flaw. Read together, the pair takes an attacker from no credentials to full administrator. This article focuses on the authentication half; the second half is treated in its own analysis.

Mechanism and exploitation conditions

The defect sits in how RouterOS decides whether an incoming SSH session is allowed to proceed. A correctly written authentication path makes a positive decision only after verifying a secret the client must possess. CWE-306 describes the opposite: the critical function executes without that verification step being enforced. The practical consequence is that a request which should be rejected is instead serviced.

Two conditions bound the exposure. First, the SSH management service must be reachable over the network. A device whose SSH listener is confined to a trusted management segment is not directly reachable by an internet attacker; a device with SSH published to the public internet is. Second, the vulnerable RouterOS build must be running. CERT Polska's guidance is blunt about the first condition: any MikroTik device with SSH exposed to the internet should be treated as compromised until proven otherwise.

What an attacker does not need is as important as what they do. There is no password to guess and no private key to steal. The flaw removes the requirement for either. That is what separates CWE-306 from a weak-credential problem: rotating passwords does not close it, because the password was never the gate.

Impact

A router sits on the boundary between an untrusted network and everything behind it. Full control of that device is not a single-system compromise; it is control of the boundary. An attacker who holds administrator rights on a RouterOS device can create new privileged accounts, alter routing and firewall policy, change DNS resolution, install scripts that run on schedule, and use the device as a relay into the internal network or as a place to hide traffic.

Because the device is always on and rarely watched, the compromise can persist quietly. Operators may notice nothing until traffic is already being redirected or credentials are already being harvested. CERT Polska's framing captures the risk: an exposed MikroTik router is a forgotten edge device, and a forgotten edge device that has been taken over is a standing foothold.

Affected products and scope

The vulnerable builds, per vendor and CERT Polska guidance, are:

  • RouterOS 6.x before 6.49.21
  • RouterOS 7.x before 7.23.4
  • RouterOS 7.24 before 7.24.2

RouterOS runs on MikroTik's RouterBOARD hardware and on the Cloud Hosted Router (CHR) virtual image, and it is common in small and mid-sized networks, ISPs, branch offices, and wireless deployments. The population of affected devices is large, but reachability is the deciding factor. A device that never exposes SSH to the internet is not directly exploitable through this path, even if it runs a vulnerable build.

Exposure context

A ZoomEye search for app="RouterOS" returns 2,854,024 matching assets as of 2026-09-16. That figure describes devices whose fingerprints match RouterOS; it does not assert that every one of them is vulnerable, nor that every one exposes SSH to the internet. It establishes the scale of the population an attacker can scan. A CVE-specific filter, vul.cve="CVE-2026-67277", returned zero indexed assets at the same time, which is expected for a recently disclosed flaw and does not contradict the product-level count.

Remediation and mitigations

Upgrade. MikroTik shipped fixes in RouterOS 6.49.21, 7.23.4, and 7.24.2. Devices on the long-term 6.x branch should move to 6.49.21 or later; 7.x long-term users should move to 7.23.4 or later; stable-branch users should move to 7.24.2 or later. Firmware is available from MikroTik's download page.

Upgrading is necessary but not sufficient on a device that may already be compromised. CERT Polska advises treating any internet-exposed MikroTik router as suspect until it has been checked. Concretely:

  1. Restrict SSH. If remote administration is not required, disable it. If it is, allow only trusted source addresses and move management onto a dedicated network.
  2. Audit accounts and scripts. Look for accounts you did not create and scheduled scripts you did not author. A high-privilege account named ops has been reported in intrusions.
  3. Check logs for the username -2. SSH log entries showing that account are a reported indicator of exploitation.
  4. Review the new Flagged self-check. Recent RouterOS builds run a startup check for known tampering and flag the device if they find it.
  5. If tampering is confirmed, treat the device as compromised. Changing a password is not enough when the attacker already held administrator rights; a rebuild or factory reset followed by a clean configuration is the safe path.

References

Top comments (0)