SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78Vexday Risk Score
Prioriza la corrección. Ella está bajo explotación confirmada por CISA y tiene prueba de concepto pública.
ssvc Actcvss 9.2epss 0.4%
de la publicación al arma
Publicada en NVD5 sept
CISA KEV+5d
probabilidad de explotación
0.4%top 66% de las CVE
explotación observada
síCISA + VulnCheck
1 exploit(s) público(s)
RouterOS contains an argument-handling flaw in the SSH login
path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Mikrotik · RouterOSPoCs públicas encontradas — 1
cve_referencenpratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://cert.pl/en/posts/2026/09/mikrotik-routeros-cvehttps://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800https://mikrotik.com/supportsec/september-2026-vulnerability/https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060