MikroTrick: Taking Over MikroTik Routers Without a Password or Key

Poland's CERT Polska has published a detailed breakdown of an attack it calls MikroTrick. Two SSH vulnerabilities in RouterOS, joined into a single chain, let attackers take full administrative control of MikroTik routers whose SSH service was reachable from public networks — with no password, no SSH key, and no completed authentication.

The chain combines a flaw in the SSH state machine (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at least September 2, one day before MikroTik shipped fixes in RouterOS 6.49.21, 7.23.4, and 7.24.2. Back on September 5 CERT Polska had already warned of exploitation, but at the time it did not disclose which two flaws formed the chain.

How the chain works

SSH requires three steps in order: it establishes an encrypted connection, authenticates the user, and only then opens a session for running commands. CVE-2026-67279 breaks that sequence: if a client starts an SSH key renegotiation during authentication, vulnerable RouterOS jumps straight to the command phase once renegotiation finishes, without ever confirming the user's identity. On its own the flaw grants no privileges, but it lets an unauthenticated client reach a stage that should require a completed login.

The second bug turns that access into full control. RouterOS launches a login program, /nova/bin/login, passing it the username and a privilege level as command-line arguments — without checking the username. A value beginning with a hyphen is treated as an option. The attacker sends -2 as the username, and the program reads its identity and privilege level from file descriptor 2, which points to the SSH session's terminal. Through the SSH channel the attacker has already written a chosen username and full administrative privilege there — and receives a privileged console.

Traces of exploitation

The attack leaves a distinctive mark: a failed login for user -2. Such entries appeared on the MikroTik forum as early as September 2. One diagnostic report shows the full sequence: rejected authentication for -2, a forced renegotiation, a jump to the channel phase, and an attempt to create a user named ops with full privileges. Other reports confirm the ops account was indeed created, and in some cases diagnostic-file creation was followed by data transfers to an attacker IP — likely a copy of the configuration.

CISA added CVE-2026-86060 to its Known Exploited Vulnerabilities catalog on September 10. No authoritative count of compromised devices has been published.

What to check

Patching stops the attack but does not undo changes made beforehand. CERT Polska advises checking the Flagged status with /system/device-mode/print, while noting the mechanism catches only selected traces. Indicators include the -2 username in logs, the ops account, and the IPs 82.192.72.4 and 103.102.31.18. Administrators should also look for unknown users, scripts, scheduler entries, tunnels, proxies, .rif files, and unexplained fetch activity. If found, the device should be isolated, its logs preserved, factory-reset, and rebuilt from a trusted configuration, with all credentials changed.

Notably, during the research CERT Polska used AI models — including GPT-5.5-cyber and GPT-5.6-sol via OpenAI's GTAC program, alongside locally hosted open-weight models — to automate laboratory testing and protocol analysis. Every finding was verified against real RouterOS systems.

Source: The Hacker News