DEV Community

jeffrey
jeffrey

Posted on

RouterOS Administrative Takeover Without Credentials: A Defensive Reading of CVE-2026-86060

#vulnerability #routeros #mikrotik #ssh

RouterOS Administrative Takeover Without Credentials: A Defensive Reading of CVE-2026-86060

Vulnerability overview

CVE-2026-86060 is the second component of the MikroTrick chain in MikroTik RouterOS and the one that produces privilege. Fixed in the September 2026 RouterOS releases and analysed in detail by CERT Polska, it is an argument-injection flaw in the login helper that RouterOS starts when an SSH client requests a shell. The defect is small, the consequence is not.

Mechanism and exploitation conditions

The helper is invoked with a fixed argument pattern that ends in the username and the user's effective policy mask. That username is taken from the SSH authentication request and, in vulnerable builds, passed through without validation.

The helper also supports an option form in which a natural number selects a file descriptor. On encountering it, the process reads a record from that descriptor and interprets the first NUL-separated field as a username and the second as the policy mask. Because the process's first three descriptors are bound to the same pseudo-terminal input queue, and because an SSH client can write to that queue as channel data, a username of -2 causes the process to read both values from the attacker.

The mask value 655358 corresponds to the RouterOS full group, so the attacker supplies their own authorisation level. Reaching this code path in the observed campaign was made easier by CVE-2026-67279, which yields the required channel without authentication, but the privilege escalation belongs to CVE-2026-86060.

Impact

A full-policy console on a RouterOS device allows routing and firewall manipulation, tunnel and VPN key access, account creation and configuration changes that survive a reboot. The observed activity also included exporting a diagnostic file to an external host, indicating collection rather than a one-off intrusion. For an organisation, the most durable harm is usually credential disclosure: any secret that transited the device should be considered exposed.

Affected products and scope

All RouterOS builds that predate the added username validation belong in scope. The September 2026 releases carry the fix, and their behaviour changed in a second, informative way: the Flagged mechanism now detects and disables an ops account in the privileged full group. That addition is a vendor-side acknowledgement of what happened in practice.

Exposure for this topic was measured with os="RouterOS" && service="ssh" and returned 9,559 devices. This figure describes RouterOS SSH reachability, not confirmed exploitation.

Remediation and mitigations

  • Update RouterOS to a fixed build and confirm the running version afterwards.
  • Verify the account list on every managed device; an ops account with full policy you did not create is evidence of compromise.
  • Restrict the management plane so SSH is not reachable from untrusted networks.
  • Review SSH logs for hyphen-prefixed usernames before and after the update date.
  • Rotate credentials, certificates, VPN keys and any pre-shared secrets stored on affected devices.
  • Re-baseline firewall and routing configuration on devices with findings.

References

Top comments (0)