EUVD-2026-72029
GHSA-6425-cjxv-52gp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N/UI:N) but requires a specific malformed-username trigger, mapping the 4.0 AT:P condition to AC:H; policy-mask escalation yields full C/I/A on the device.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
6DescriptionCVE.org
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Lont-term), 7.23.4 (Lont-term) and 7.24.2 (Stable)
Articles & Coverage 1
AnalysisAI
Privilege escalation in MikroTik RouterOS lets a remote, unauthenticated attacker abuse the SSH login helper to rewrite the trusted RouterOS policy mask by supplying a username that begins with a prohibited character. Because the flaw is reached before authentication completes, an attacker who can open an SSH session to an affected device can escalate to full administrative privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to the RouterOS SSH service and the ability to open an unauthenticated SSH session to the RouterOS login helper - no valid credentials and no user interaction are needed (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority issue rather than an inflated CVSS score: the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.2) describes a network-reachable, unauthenticated flaw with full confidentiality/integrity/availability impact, tempered only by an attack requirement (AT:P) that reflects the specific malformed-username condition needed to trigger it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade RouterOS to 6.49.21 (Long-term), 7.23.4 (Long-term) or 7.24.2 (Stable) as appropriate for your branch, per the MikroTik advisory (https://mikrotik.com/supportsec/september-2026-vulnerability/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MikroTik RouterOS devices in your environment and immediately restrict SSH access to authorized management IP addresses only, or disable remote SSH entirely if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote unauthenticated exploitation of MikroTik RouterOS's Bandwidth Test (btest) service allows two distinct attacks: k
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remot
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Rated
Authentication bypass in MikroTik RouterOS lets a remote unauthenticated attacker log in over SSH as an authorized user
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. Rated high
Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface.
Unauthenticated file read in MikroTik RouterOS WebFig exposes root-owned configuration files - including credential stor
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consu
MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /expo
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today