EUVD-2026-72029
GHSA-6425-cjxv-52gp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed RouterOS SSH service
-
DeliveryOpen unauthenticated SSH session
-
ExploitSubmit username with prohibited leading character
-
ExecutionInject argument into login helper
-
PersistRewrite trusted policy mask
-
ImpactGain administrative control of router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Argument sanitization
|
| Exploitation Conditions | Requires network reachability to the RouterOS SSH service and the ability to open an unauthenticated SSH session to the RouterOS login helper - no valid credentials and no user interaction are needed (PR:N/UI:N). The specific trigger is a username string that begins with a prohibited character, which the login path mishandles to alter the trusted policy mask (the AT:P / attack-requirement condition). Exploitation is limited to devices where SSH is exposed to the attacker (SSH restricted to management networks or firewalled off substantially reduces exposure) and to RouterOS versions prior to 6.49.21, 7.23.4, and 7.24.2 within their branches. |
| Impact | This is a genuinely high-priority issue rather than an inflated CVSS score: the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.2) describes a network-reachable, unauthenticated flaw with full confidentiality/integrity/availability impact, tempered only by an attack requirement (AT:P) that reflects the specific malformed-username condition needed to trigger it. Public exploit code is confirmed, and the reporting CERT (CERT-PL) has a separate post explicitly framing these RouterOS vulnerabilities as actively exploited, which raises urgency beyond mere POC availability - even a mid-sized municipal IT team in kalisz running edge MikroTik routers should treat this as urgent and patch immediately. The main limiting factor is reachability: exploitation requires the SSH service to be exposed to the attacker, so devices with SSH restricted to management VLANs or firewalled from untrusted networks face materially lower real-world risk. No EPSS score is provided and CISA KEV status is not present in the input, so 'confirmed actively exploited (CISA KEV)' cannot be asserted from this data alone despite the vendor/CERT exploitation claims. |
| Exploit ScenarioDerived | An attacker scans the internet for MikroTik devices with SSH exposed, opens an unauthenticated SSH session, and submits a specially crafted username that starts with the prohibited character to inject an argument into the RouterOS login helper. This rewrites the session's trusted policy mask, granting administrative policy rights and effectively full control of the router; public exploit code lowers the skill barrier to do this at scale. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 05, 2026
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite the trusted RouterOS policy mask by supplying a username that begins with a prohibited character. Because the flaw is reached before authentication completes, an attacker who can open an SSH session to an affected device can escalate to full administrative privileges. Publicly available exploit code exists, and CERT-PL (the reporter) has published a companion advisory describing these RouterOS issues as actively exploited, though the CVE is not confirmed on CISA KEV in the provided data.
RemediationAI
Vendor-released patch: upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as appropriate for your branch, per the MikroTik advisory (https://mikrotik.com/supportsec/september-2026-vulnerability/). Until patched, restrict exposure of the SSH service: disable SSH entirely if not needed, or bind and firewall it so it is only reachable from trusted management networks/hosts (RouterOS 'IP > Services' address restrictions and firewall input rules), and change the SSH port off the default only as a minor obfuscation, not a fix. These controls reduce reachability of the vulnerable login helper but do not remove the flaw, so patching is the only complete remedy; also audit affected devices for signs of compromise (unexpected admin accounts, altered permissions, config changes) given public exploit code and CERT-PL's active-exploitation reporting. Review the reverse-engineering write-up (https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/) for detection context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is MikroTik RouterOS (cpe:2.3:a:mikrotik:routeros), the operating system that runs on MikroTik's RouterBOARD and CHR router/appliance line. The root cause is CWE-88 (improper neutralization of argument delimiters, i.e. argument injection): the SSH login path passes the supplied username into the RouterOS login helper without properly rejecting or neutralizing a leading 'prohibited character'. That leading character causes the helper to interpret part of the input as an argument that manipulates the account's trusted policy mask - the internal permission/policy bitmap RouterOS uses to decide what a session is allowed to do - so an attacker-controlled username effectively grants elevated policy rights. The npratley.net reference reverse-engineers the 'silent' 7.23.4 fix, indicating the patch hardens how the login helper parses/validates the username argument.
Know when Routeros gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable and unauthenticated (AV:N/PR:N/UI:N) but requires a specific malformed-username trigger, mapping the 4.0 AT:P condition to AC:H; policy-mask escalation yields full C/I/A on the device.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
3DescriptionCVE.org
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Lont-term), 7.23.4 (Lont-term) and 7.24.2 (Stable)
Articles & Coverage 3
Technical POC Analysis
The flaw is CWE-88 argument injection in the SSH login path.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from exploitdb
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
MikroTik RouterOS devices are vulnerable to unauthenticated remote attacks that can result in complete administrative compromise, with publicly available exploit code already in circulation. The vulnerability threatens network infrastructure integrity and could enable attackers to intercept traffic, redirect communications, and establish persistent access within enterprise networks. With no patch currently available, immediate network access controls are critical to prevent exploitation.
Restrict SSH access via network firewall rules to authorized management addresses only; disable remote SSH if not operationally required; implement out-of-band management network isolation for critical routers; enable comprehensive SSH access logging with real-time alerts for failed authentication and suspicious command execution; monitor for exploitation signatures; maintain inventory of potentially compromised routers for post-patch forensic review.
Threat Model
4 threats: Elevation of Privilege, Tampering, Spoofing and 1 more
4-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: k
SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-a
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remot
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stor
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consu