Attackers Hijack Mikro Tik Routers Through Internet-Exposed SSH Without Authentication
Summary: CERT Polska published an attack warning on September 5 about attackers exploiting MikroTik routers whose SSH remote-access service is reachable from the internet, gaining full administrative control without authentication, with successful attacks dating to at least September 2. CERT calls the reported two-flaw combination MikroTrick, but neither its warning nor the vulnerability disclosure identifies which two vulnerabilities form the chain or explains how they combine to grant administrative control.
What's compelling: An internet-exposed SSH service on a MikroTik router can hand an attacker full administrative control with no credentials at all, and CERT's guidance to check for unexpected highly privileged ops accounts and account-creation logs containing ssh:-2@ is the only signal named for spotting it after the fact.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026