Technology
Security analysis reveals privilege escalation flaws behind silent MikroTik RouterOS updates
Reverse engineering of new RouterOS builds exposes an SSH authorization bypass and remediation code addressing active exploitation.
The short version
- MikroTik released RouterOS updates across three branches on September 3, 2026, withholding vulnerability details to allow administrators time to patch.[Hacker News]
- Binary analysis revealed three security flaws, including an SSH parser issue where a username of -2 enables authenticated read-only users to escalate to full command execution.[Hacker News]
- The updated releases reject invalid username inputs and deploy remediation routines to remove malicious configurations matching active attack traces.[Hacker News]
- Researchers note that a method for unauthenticated attackers to supply the triggering username remains unproven without external authentication setups like RADIUS.[Hacker News]
Key facts
- MikroTik released RouterOS updates 7.23.4, 7.24.2, and 6.49.21 on September 3, 2026, without publishing specific vulnerability details.[Hacker News]
- Binary comparison revealed that an SSH username of -2 triggers legacy file descriptor handling in the login parser, allowing authenticated read-only sessions to apply a full administrative policy mask.[Hacker News]
- The vulnerability behavior matched active exploitation traces where an unauthorized administrative account was created under the username ops.[Hacker News]
- RouterOS 7.23.4 introduces username input validation and automatic remediation logic to detect and disable known malicious configurations upon reboot.[Hacker News]
What remains uncertain
- It remains unverified whether an attacker can supply the -2 username to standard SSH without relying on external authentication backends such as RADIUS.[Hacker News]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.