Роскомнадзор поручил операторам проверить роутеры MikroTik

Russia's radio frequency monitoring body GRChTs, which reports to telecom regulator Roskomnadzor, has advised internet providers to inspect MikroTik routers on their networks and among subscribers after confirming active exploitation of six recently disclosed RouterOS vulnerabilities. CERT Polska first flagged the flaws in early September, highlighting a chained exploit dubbed MikroTrick that combines CVE-2026-67276 and CVE-2026-86060 (both rated 9.2 on CVSS) to let attackers seize full control of internet-exposed SSH interfaces without any password or private key — abusing flawed RSA key validation and a crafted username for privilege escalation. Real-world attacks using this chain were reportedly detected as early as September 2, and four additional bugs affecting SSH, the bandwidth-test tool, X.509 certificate handling and the WebFig web interface can enable remote command execution, file tampering, memory leaks, forged TLS certificates or forced reboots. GRChTs is now asking operators to temporarily restrict remote access to MikroTik management ports, monitor traffic from vulnerable devices, and notify customers to patch — warning that unresponsive subscribers after a week could face port-level traffic limits, even though compliance with the recommendation and device updates remain voluntary for operators. MikroTik has fixed all six issues in RouterOS 6.49.21, 7.23.4, 7.24.2 and 7.25beta3, with 7.23.5 recommended instead for users on the 7.23 branch to also address an IPv6 DHCP bug; administrators unable to patch immediately are urged to block internet access to SSH, WWW, WWW-SSL and bandwidth-test or restrict it to trusted networks only.