MikroTrick: Inside the RouterOS Takeover Chain

What it is

"MikroTrick" is an unauthenticated SSH takeover chain against MikroTik RouterOS, combining CVE-2026-67279 (authentication-state bypass via SSH rekey) and CVE-2026-86060 (login-helper control-syntax injection via the username). CERT Polska published the advisory (six total vulnerabilities) on September 5, 2026; Bishop Fox reproduced full administrative takeover on RouterOS 7.x and found compromised internet-facing devices. Full takeover works on 7.x; on 6.x the stage-one bypass triggers but the same construction does not yield an admin session.

How it works

The login helper has a legacy feature: a username beginning with a dash is read not as a name but as a file-descriptor selector — the helper reads a trusted identity record (username + policy mask) from that FD. On 7.x the vulnerable helper accepts descriptors 0–32, reads up to 0x1000 bytes, and parses the first two NUL-delimited fields; the 6.x helper lacks the descriptor upper-bound check. Because rekey put the attacker's terminal on FD 2, supplying username -2 makes the helper adopt an attacker-supplied admin identity from the session terminal.

Affected / what to update to

Update to 6.49.21, 7.23.4, 7.24.2, or later for the relevant branch — these fix all six advisory vulnerabilities. The 7.24 branch was outside Bishop Fox's lab matrix; assess by installed version. Detector was validated vulnerable on 6.49.20 and 7.23.3, patched on 6.49.21 and 7.23.4.

What to do

Patching prevents new exploitation but does not remove attacker-created accounts, scripts, or schedulers — treat affected routers as potentially compromised. RouterOS logs are memory-resident and may not cover the compromise window; durable config objects are the better record.

Hunt for objects RouterOS renders with numeric owner owner="0" (chain-created objects show this instead of a named admin — a hunting lead, not proof, since legitimate service/imported objects can also appear). Observed persistence: a script logrotate and scheduler daily-maint (03:00, daily) that recreates a full-privilege account if removed, with a per-device password.

/system script print detail where owner="0"
/system scheduler print detail where owner="0"

Also review privileged users, configuration history, remote logs, the RouterOS flagged state, proxies, and tunnels. If compromise is suspected, collect config and logs before resetting, reconfigure from a verified baseline, and rotate every secret the router stored or could observe.

The non-invasive detector opens two connections: a control channel (no rekey) and a test channel (rekey first). A vulnerable build refuses the control channel but opens the test channel after rekey. Only that differential yields a vulnerable verdict; timeouts and algorithm mismatches stay inconclusive. Patched builds return status 2 with no descriptive error, which Paramiko reports as Negotiation failed.

Caveats

Bishop Fox confirmed the stage-one authentication-state bypass but did not exercise the CERT-reported unauthenticated file-manipulation operations. The numeric-owner rendering links the tested chain to field artifacts but does not prove every owner="0" object came from MikroTrick.