MikroTik just dropped a security bulletin warning that RouterOS vulnerabilities aren’t just theoretical—there are already signs of exploitation in the wild. Since Sept 3, the vendor has shipped multiple security updates (including 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21). The recommendation is simple: upgrade ASAP. But the bulletin also adds a crucial twist: after upgrading, RouterOS will run intrusion/abnormality checks—yet you still need to audit your device-side configuration. Look for unknown scripts, new user accounts (especially anything you didn’t create), and unexpected high-privilege config changes. Even a patched system can remain compromised if attackers already got in. Then CERT Polska escalated the alert: they confirmed internet-facing attacks are actively being used after reviewing MikroTik’s disclosures. Using AI-assisted modeling (noted as a GPT-type security model), they identified 6 weaknesses that can chain together as “MikroTrick.” If SSH remote access is enabled and the attacker can reach it without valid auth, the chain may lead to full device control. Watch logs for telltale SSH actions and a high-privilege user named “ops.” Key CVEs include CVE-2026-67276 (9.2) and CVE-2026-86060 (9.2), plus CVE-2026-67277 (8.8) with a possible memory leak/crash.
Want to learn more? Visit Explore the world, stay updated on travel insights and international affairs, and discover authentic stories from real life
评论
发表评论