Уязвимости RouterOS позволяют захватывать маршрутизаторы MikroTik через SSH

CERT Polska has reported active exploitation of six vulnerabilities in MikroTik RouterOS, with attacks first detected on September 2, 2026. The combined flaws, dubbed "MikroTrick," enable attackers to gain administrative control over devices without authentication if SSH is accessible from the internet.

The affected vulnerabilities are CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, and CVE-2026-86060. Two of these carry a critical CVSS score of 9.2: CVE-2026-67276 allows signature spoofing during SSH authentication due to incomplete RSA key verification, while CVE-2026-86060 permits privilege escalation through crafted usernames. Other issues include pre-authentication command execution (CVE-2026-67279), memory disclosure or DoS via bandwidth-test (CVE-2026-67277), TLS certificate forgery (CVE-2026-67278), and unauthorized file reads via WebFig (CVE-2026-67281).

MikroTik has released patches in RouterOS versions 6.49.21, 7.23.4, 7.24.2, and 7.25beta3. Administrators should update immediately, scan logs for suspicious activity such as the 'ops' user or accounts containing 'ssh:-2@', and restrict external access to management interfaces if patching cannot be performed instantly.