https://www.phllaps.net/tags/mikrotik/ Recent content in MikroTik on PhllapsNET Hugo en-gb Thu, 10 Sep 2026 00:00:00 +0000 https://www.phllaps.net/posts/mikrotik-routeros-improper-neutralization-of-argument-delimiters-in-a-command-vulnerability/ Thu, 10 Sep 2026 00:00:00 +0000 https://www.phllaps.net/posts/mikrotik-routeros-improper-neutralization-of-argument-delimiters-in-a-command-vulnerability/ <div style="background:#b91c1c;color:white;padding:16px 18px;border-radius:14px;font-weight:800;font-size:18px;display:flex;align-items:center;gap:12px;box-shadow:0 10px 24px rgba(0,0,0,0.18);"><span style="font-size:24px;">🚨</span><span>SEVERITY: CRITICAL — CVSS 9.8</span><span style="opacity:0.95;font-weight:700;margin-left:auto;">Security Advisory</span></div> <h2 id="tldr-">TL;DR 📌</h2> <ul> <li>MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation.</li> <li>Highest CVSS: <strong>9.8 (Critical)</strong>.</li> <li><strong>Listed in CISA KEV</strong> (2026-09-10) — this is being exploited in the wild.</li> <li><strong>Fixed in <code>6.49.21</code>, <code>7.23.4</code>, <code>7.24.2</code></strong> — upgrade to this release or later.</li> <li>CVEs: CVE-2026-86060.</li> </ul> <h2 id="what-it-is">What it is</h2> <p>CVE-2026-86060 is an argument-injection flaw in the SSH login path of MikroTik RouterOS. The vulnerability arises from improper neutralisation of argument delimiters when RouterOS parses usernames at login: a username starting with a prohibited character can be used to alter the trusted RouterOS policy mask, the internal structure that governs what a session is permitted to do.</p> https://www.phllaps.net/posts/mikrotik-routeros-missing-authentication-for-critical-function-vulnerability/ Thu, 10 Sep 2026 00:00:00 +0000 https://www.phllaps.net/posts/mikrotik-routeros-missing-authentication-for-critical-function-vulnerability/ <div style="background:#dc2626;color:white;padding:16px 18px;border-radius:14px;font-weight:800;font-size:18px;display:flex;align-items:center;gap:12px;box-shadow:0 10px 24px rgba(0,0,0,0.18);"><span style="font-size:24px;">🚨</span><span>SEVERITY: HIGH — CVSS 8.2</span><span style="opacity:0.95;font-weight:700;margin-left:auto;">Security Advisory</span></div> <h2 id="tldr-">TL;DR 📌</h2> <ul> <li>MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.</li> <li>Highest CVSS: <strong>8.2 (High)</strong>.</li> <li><strong>Listed in CISA KEV</strong> (2026-09-10) — this is being exploited in the wild.</li> <li><strong>Fixed in <code>6.49.21</code>, <code>7.23.4</code>, <code>7.24.2</code></strong> — upgrade to this release or later.</li> <li>CVEs: CVE-2026-67277.</li> </ul> <h2 id="what-it-is">What it is</h2> <p>CVE-2026-67277 sits in the btest service in RouterOS, MikroTik&rsquo;s bandwidth-testing tool. The flaw is a missing authentication check: RouterOS accepts a &ldquo;related&rdquo; btest connection before the corresponding primary session has finished authenticating. This lets an unauthenticated client on the network start an IPv4 UDP test against the device without ever completing a valid login.</p>