MikroTik Critical Vulnerabilities Patched After Router Hack Exploits

Post Views: 16

Network equipment vendor MikroTik has released updates addressing six vulnerabilities in RouterOS, urging users to apply the patches immediately.

Overview of the Vulnerabilities

MikroTik’s advisory highlights the urgency of the updates, emphasizing that while most configurations are not at immediate risk, proactive mitigation is critical. The vendor recommends blocking SSH access from untrusted sources and monitoring logs for entries marked as “Flagged.”

Active Exploitation of Flaws

CERT Poland confirmed the exploitation of these vulnerabilities, noting that attackers have combined them to compromise systems with publicly accessible SSH services. The vulnerabilities, designated as MikroTrick, enable threat actors to bypass authentication mechanisms and gain control of affected devices.

Specific Vulnerabilities Addressed

The vulnerabilities include three critical flaws: CVE-2026-67276 (CVSS score 9.2), which enables an SSH authentication bypass; CVE-2026-86060 (CVSS score 9.2), allowing manipulation of SSH session privileges; and CVE-2026-67277 (CVSS score 8.8), a memory disclosure and denial-of-service vulnerability. Additional fixes include CVE-2026-67278 (TLS server impersonation), CVE-2026-67279 (unauthenticated file tampering), and CVE-2026-67281 (disclosure of root-owned files).

Exploitation Details and Recommendations

CERT Poland reported that malicious actors have leveraged the vulnerabilities since at least September 2, creating a user account named ‘ops’ during attacks. The compromised devices were accessed via IP addresses 82.192.72.4 and 103.102.31.18.

Immediate Actions for Users

Users are advised to update RouterOS to versions 7.25beta3, 7.24.2, 7.23.4, or 6.49.21. The advisory also notes that the exploitation of these vulnerabilities could lead to full device control, enabling data exfiltration, configuration changes, or network infiltration.

Widespread Risk and Mitigation Strategies

A separate analysis by the Shadowserver Foundation revealed over 120,000 MikroTik devices with exposed SSH services during a September 5 scan. This underscores the widespread risk posed by unpatched systems. Organizations are urged to prioritize patching and implement network segmentation to limit potential attack surfaces.

CERT Poland warned that the presence of specific artifacts, such as the ‘ops’ account or logs indicating exploitation attempts, requires immediate investigation. However, the absence of these indicators does not guarantee security, as attackers may employ stealthier methods.

Threat Landscape and Security Measures

Threat intelligence reports suggest that the exploitation of MikroTrick vulnerabilities aligns with broader campaigns targeting misconfigured IoT and network infrastructure. Security teams should review logs for suspicious activity and consider deploying intrusion detection systems to identify anomalous SSH traffic.

Conclusion

Proactive mitigation and timely updates are critical to safeguarding systems against these vulnerabilities. Users must remain vigilant and follow the recommended security practices to prevent potential breaches.