MikroTik Routers Hacked via Two Chained SSH Flaws
Attackers bypassed login on exposed MikroTik devices using a specific vulnerability chain.
Key points
- Two chained SSH flaws allowed unauthenticated attackers to gain full administrative control of MikroTik routers.
- Attackers exploited the vulnerabilities by sending a specific hyphenated value to bypass identity verification.
- Patches were released in late September after evidence of exploitation appeared in device logs.
Administrators of MikroTik routers face a serious security risk due to a pair of linked flaws in the Secure Shell (SSH) service. These vulnerabilities allow attackers to seize full control of devices without needing a password, a private key, or any form of successful authentication.
The issue, dubbed MikroTrick by Poland’s national computer security center, involves two specific bugs that work together to bypass standard security checks. Evidence suggests these flaws were actively exploited before the manufacturer released patches in late September.
How the bypass mechanism functions
Normally, an SSH connection requires three distinct steps: establishing a link, verifying the user's identity, and then opening a command session. The first flaw disrupts this order. If a client initiates a specific type of key renegotiation during the verification phase, the vulnerable router skips the identity check entirely and moves straight to the command phase.
This initial step alone does not grant access, but it allows an unverified user to reach a stage that should be protected. The second flaw exploits this position by manipulating how the system interprets command-line arguments. By sending a value that begins with a hyphen, the attacker tricks the login program into treating their input as a system instruction rather than a username.
Evidence of active exploitation
The Hacker News reports that logs from affected devices show a distinct pattern: a failed login attempt for a user named -2. This specific trace appeared in public forums before the fixes were available, indicating that the attack was already in motion. Security researchers confirmed that on some devices, attackers successfully created privileged accounts and exfiltrated configuration data to external servers.
While the chain requires the SSH service to be reachable from the internet, many professional networks expose this port for remote management. The catch is that even if the default home configuration hides SSH, any manual exposure to the public network leaves the device vulnerable to this specific sequence of attacks until the patch is applied.
Required action for administrators
MikroTik released updates for RouterOS versions 6.49.21, 7.23.4, and 7.24.2 to address these issues. The US Cybersecurity and Infrastructure Security Agency has also added the relevant flaw to its list of known exploited vulnerabilities. Users must update immediately and review their device logs for signs of unauthorized access, particularly looking for the distinctive -2 login attempts.
