Analysis identifies two flaws behind exploited MikroTik router takeover chain

CERT Polska has identified the two RouterOS SSH flaws behind a previously reported attack that can give intruders administrative control of exposed MikroTik routers without completing authentication. One flaw lets a connection reach the command stage early; the other lets a crafted username influence the login program's privilege settings. Attack logs date to at least September 2, before MikroTik released fixes the next day. CERT Polska's latest analysis explains how the flaws work together and reports successful account creation on affected devices. The chain requires SSH to be reachable by the attacker, and no authoritative count of compromised devices has been published.