Latest / The Digital Warfare Podcast / EP. 158: Hackers Exploit MikroTik RouterOS Flaws to Take Over Routers
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we're looking at an attack that can turn an exposed router into infrastructure controlled by an attacker. The target is MicroTick Router OS. The attack chain has been named Micro Trick, and security researchers have confirmed that attackers are already exploiting it against internet accessible devices. The result? Potentially full administrative control of the router. Here's what happened. Researchers at Cert Polska discovered six vulnerabilities affecting different components of MicroTick Router OS. But two vulnerabilities stand out because of what happens when they're combined. The first is CVE-2026-67276. It carries a CVSS score of 9.2 and affects SSH authentication. Router OS did not completely verify RSA public keys when matching an SSH authentication request against an authorized user's key. In particular, it checked the key type and modulus, but failed to properly account for the complete key. That created an authentication bypass condition. An attacker who knows the username and public modulus associated with an authorized RSA key can construct a different key and authenticate without possessing the legitimate private key. That is already serious. But the second vulnerability makes the chain considerably more dangerous. CVE-2026-86060. ⁓ It also carries a CVSS score of 9.2. This vulnerability involves the way Router OS handles specially crafted usernames during SSH authentication. By manipulating that username, an attacker can alter the privileges associated with the SSH session. The result is full administrative privileges. Put those vulnerabilities together and the attack becomes much clearer. The first weakness can help bypass SSH authentication. The second can elevate the resulting session to full administrative control. And this isn't simply a theoretical exploit chain. Cert Polska says it has observed attacks against router OS devices accessible from the Internet and obtained confirmation that attackers are exploiting the vulnerabilities to take full control of devices where SSH is exposed to public networks. That distinction matters. We're no longer talking about a proof of concept sitting in a research repository. We're talking about exploitation in the wild. And compromising a router creates a very different security problem from compromising an ordinary endpoint. The router sits at a strategic position in the network. It handles traffic. It establishes routes. It can support tunnels. It may enforce firewall rules. It can connect internal infrastructure to the internet. If an attacker obtains administrative control, defenders need to consider far more than whether the device itself has been altered. They need to ask what the attacker could do through it. Could traffic be redirected? Could malicious tunnels be established? Could firewall policies be changed? Could credentials or configuration information be exposed? Could the router become persistent infrastructure for accessing the rest of the environment? That is why edge devices remain such attractive targets. They're internet-facing. They're highly privileged, and once compromised, they can give attackers a position that sits between internal systems and the outside world. MicroTik has now released fixes. The patched versions include Router OS 7.24.2, 7.23.4, 6.49.21, and 7.25 Beta 3. MicroTic says most configurations are not at immediate risk. That's because the dangerous attack path depends heavily on SSH exposure. The company's default configuration blocks SSH access from the internet. But organizations that manually exposed management services have a different risk profile. So what should defenders do? First, update Router OS immediately. Second, do not expose SSH or other router management interfaces directly to untrusted networks. MicroTix specifically recommends limiting SSH to trusted addresses or using a VPN such as WireGuard for remote administration. Third, don't assume that installing the patch proves the router was never compromised. MicroTIC has introduced a mechanism that can mark potentially compromised devices as flagged. Check the device logs for that status, then inspect the configuration, look for unfamiliar users, unknown scripts, unexpected scheduler tasks, proxy servers, tunnels, or configuration changes that administrators cannot explain. And there's another vulnerability worth mentioning. CVE-2026-67277, rated 8.8. affects router OS's bandwidth test service and can expose kernel memory or cause a remote denial of service. So Microtrick sits inside a broader group of security defects that administrators need to address. But the larger lesson goes beyond MicroTick. Network management interfaces should not be treated like ordinary services. They are privileged control planes. SSH, Web Administration, VPN management, firewall consoles. These interfaces deserve aggressive exposure reduction. Because when an attacker compromises a workstation, they gain a foothold. When they compromise the infrastructure controlling how your network communicates, they can gain something much more powerful: position, patch the routers, restrict the management plane, and investigate exposed devices for evidence of compromise, because the device protecting the edge of your network can also become the attacker's doorway into it. This has been your Digital Warfare Daily Brief. Stay secure, we'll see you tomorrow.