According to CERT Polska, threat actors are actively targeting MikroTik routers with internet-accessible Secure Shell (SSH) services to achieve full administrative control without authentication, a vulnerability vector tracked as MikroTrick.
Network administrators managing edge devices face an urgent security window after researchers disclosed a severe authentication bypass affecting RouterOS. According to warnings published by CERT Polska on Saturday, September 5, the vulnerability allows unauthorized actors to seize complete administrative control over targeted hardware.
How the MikroTrick Attack Exploits RouterOS
The campaign centers on multiple vulnerabilities spanning built-in SSH servers and clients, bandwidth testing services, X.509 certificate processing, and the WebFig management interface. According to security disclosures, the core flaw exists because RouterOS fails to properly validate public keys utilized during SSH authentication. Specifically, the system does not compare the complete RSA public key assigned to an account.
An attacker who knows a valid username and the associated public key can generate a modified key and log in via SSH without possessing the matching private key. The resulting session inherits the permissions of the targeted user account. Additional vulnerabilities compound the risk; RouterOS improperly handles usernames beginning with unauthorized characters during SSH logins. By supplying a specially crafted username, malicious actors can elevate their session privileges up to full administrator status, according to technical findings.
Pro Tip: Setting up secure SSH access normally requires generating an RSA key pair via terminal commands such as ssh-keygen -t rsa, transferring the public key file to the router using secure copy protocols, and importing it directly into the user database using commands like /user ssh-keys import public-key-file=muj_klic.pub user=UZIVATEL. However, administrators must ensure their RouterOS software is fully patched before relying on key-based authentication.
Official Patches and Mitigation Steps
In response to the exploit chain, MikroTik has released urgent software updates. According to vendor advisories, patches are available in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. In an unprecedented move, the manufacturer also pushed direct notifications to mobile phones running the official MikroTik app.
Administrators need to apply updates immediately. Beyond patching, security guidelines dictate a thorough audit of device configurations. Teams should check systems for unauthorized user accounts, unknown scripts, unwanted scheduler tasks, proxy configurations, and unauthorized tunnels.
Did you know? This marks the first time in MikroTik’s operational history that the company utilized direct mobile application push notifications to alert users about a critical infrastructure threat.
Frequently Asked Questions
What is the MikroTrick vulnerability?
According to CERT Polska, MikroTrick is an attack vector targeting internet-accessible SSH services on MikroTik routers to gain unauthenticated administrative control.
Which RouterOS versions fix the issue?
According to the vendor, patches are included in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21.
What should administrators check after updating?
Administrators should inspect configurations for unknown user accounts, unauthorized scripts, unexpected scheduler jobs, active proxy servers, and unknown tunnels.
Have you audited your network infrastructure today? Share your security hardening experiences in the comments below, or subscribe to our newsletter for instant cybersecurity alerts.
Worth a look