CVE-2026-67279 in Mikrotik
Summary
by MITRE • 09/05/2026
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Lont-term), 7.23.4 (Lont-term) and 7.24.2 (Stable)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/06/2026
The vulnerability described involves a critical authentication bypass within the Secure Shell implementation of MikroTik RouterOS, specifically affecting versions prior to 6.49.21 in the Long-Term channel and 7.23.4 or 7.24.2 in their respective branches. This flaw stems from an improper handling of SSH protocol state transitions during key exchange operations. In a standard Secure Shell session, authentication must be completed before any application-level channels are opened. However, due to this implementation error, the server incorrectly proceeds to accept client requests for new channel sessions immediately after a rekeying event, even when no user has been authenticated. This deviation from the SSH specification allows an unauthenticated remote attacker to establish interactive shell access without providing valid credentials, effectively bypassing all intended security controls designed to restrict administrative access.
From a technical perspective, this issue represents a severe failure in session management and state validation within the cryptographic handshake process. The vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-306, Missing Authentication for Critical Function, because the system fails to verify user identity before executing privileged operations. Furthermore, this behavior can be mapped to MITRE ATT&CK technique T1078, Valid Accounts, specifically in contexts where attackers exploit default or weak credentials after gaining initial access through such protocol flaws, although here the primary issue is the lack of authentication entirely rather than credential theft. The ability to open a session channel and send an exec request means that any network-accessible device running vulnerable firmware can be remotely compromised without prior login, turning what should be a protected administrative interface into an unrestricted command execution vector.
The operational impact of this vulnerability is profound, as it enables unauthenticated creation, overwriting, and reconstruction of files within the RouterOS managed file namespace. This includes critical configuration files that dictate network routing policies, firewall rules, user accounts, and diagnostic data essential for system maintenance. An attacker leveraging this flaw can modify these files to persist malicious configurations, exfiltrate sensitive network topology information, or install backdoors that survive reboots. The ability to overwrite existing files suggests potential for denial of service by corrupting configuration states, while the creation capability allows for the deployment of persistent malware scripts. This level of access effectively grants full control over the router, compromising not only the device itself but also any network segments connected through it, potentially leading to broader infrastructure compromise including man-in-the-middle attacks or traffic interception.
Mitigation requires immediate action by updating RouterOS firmware on all affected devices. Administrators should upgrade to version 6.49.21 for Long-Term support branches or versions 7.23.4 and 7.24.2 for Stable branch deployments, as these releases contain the necessary patches to correct the SSH protocol state handling logic. In environments where immediate patching is not feasible due to operational constraints, temporary mitigations should include restricting access to the SSH service via firewall rules to only trusted IP addresses or management networks. Additionally, disabling unnecessary services and ensuring that administrative interfaces are not exposed directly to untrusted networks can reduce the attack surface. Regular auditing of system logs for unauthorized connection attempts and implementing network segmentation to isolate critical infrastructure from general user traffic further enhances resilience against exploitation of this vulnerability until permanent remediation is applied.