Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication.
The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at least September 2, one day before MikroTik shipped patches in RouterOS 6.49.21, 7.23.4, and 7.24.2.
As previously reported, CERT Polska warned on September 5 that attackers were using RouterOS flaws to take control of devices whose SSH service was reachable from public networks.
That warning confirmed the exploitation and urged immediate patching but did not identify which two flaws formed the chain or explain how they combined. This latest analysis provides both.
SSH requires three steps in order: it establishes an encrypted connection, authenticates the user, and only then lets the client open a session and run commands. The server sends a specific message (SSH_MSG_USERAUTH_SUCCESS) to confirm that authentication has passed.
CVE-2026-67279 breaks this sequence. If a client starts an SSH key renegotiation during the authentication step, vulnerable RouterOS moves straight to the command phase when the renegotiation finishes, without ever confirming the user's identity.
The flaw does not create an authenticated session or grant any privileges on its own, but it allows an unauthenticated client to reach a stage that should require a completed login.
CVE-2026-86060 turns that access into full administrative control. RouterOS launches a login program (/nova/bin/login) that receives the username and a privilege level from the SSH daemon as command-line arguments, without checking the username first.
Source link
