RouterOS

This week we're kind of going all in on networking.

Routers, switches, ethernet cables, Wi-Fi, IP addresses, and all those wonderful moments when someone says, "The network is down." Coming up on the Tech News Report, we're talking about a critical Microtech RouterOS vulnerability, a maximum severity flaw affecting older D-Link routers.

Yeah, remember D-Link? Uh, and another actively exploited vulnerability affecting Cisco's SD-WAN management platform.

Then on the repair bench, we've got a couple of networking problems we're gonna look at.

But first, let's find out what's happening in networking and security.

It's time for this week's Tech News Report.

First up this week, the Cybersecurity and Infrastructure Security Agency is warning organizations about a critical vulnerability affecting Microtech, uh, RouterOS.

The vulnerability exists in the web management service and can potentially be exploited before, uh, a attacker even authenticates.

Three, a single request to a microtic router's web interface can run code as root with no login.

It's a different flaw from the SSH bugs attackers used on RouterOS last month.

This one isn't known to be exploited yet.

Expect that to change.

Upgrade RouterOS and keep the web interface off of the internet.

Four, TeamViewer's session permissions are supposed to limit what the person you let in can do.

A flaw lets that person change those permissions as the session starts.

So let's move from the upcoming deadline to the fires that are burning on the network right this second.

The remaining additions to Cease's KevCatalog involve Microsoft SharePoint and Microtech RouterOS.

Yeah, and both of these are showing clear evidence of active exploitation in the wild, and they both represent severe structural risks to an enterprise.

Let's start with SharePoint and CVE-2026-65660.

Get the patches applied before the September 30th deadline.

And if you can't, aggressively monitor your WAF logs for anomalous UDP traffic.

And finally, your immediate drop-everything priorities for today are Microsoft SharePoint and MikroTik RouterOS.

Do not let that old spoofing classification lull you into a false sense of security with SharePoint.

We'll look at a zero-click Exchange vulnerability that immediately jumped to the top of patch priority lists, a campaign where AI agents are autonomously compromising online retailers for about $25 a target, and ShinyHunters claim that it breached the FBI, not for money this time, but apparently for revenge.

And later in the show, I'll sit down with Bishop Fox adversarial operator Emilio Gallegos to unpack his microtrick research, uh, the RouterOS exploit chain that attackers were already using before defenders even knew it existed, and what organizations should be checking for now.

This is Initial Access.

[intro music] I'm Sean McMillan, community manager here at Bishop Fox, and I'm joined today by Kendrick Urbaniak, senior operator exploit developer, and Sergio Villegas, senior managing analyst.

[laughs]

Yeah.

It's CVEA, which ends in 67279, um, essentially is a failure in that sequence because on a vulnerable RouterOS build, um, even though it, it never really asks you for authentication, you can request a process that is known as rekey, where essentially you're negotiating a new set of keys.

[chuckles] And the server, when you initiate that process, it sort of takes you to the next step, which allows you to essentially open, like, a new session channel.

If you run Roundcube, patching this is a tonight job, not a this week one.

Mikrotik shipped a quiet RouterOS update earlier this month, calling it important without saying what it fixed.

That silence did not hold.

Researchers with an assist from AI chained two of the patched flaws into an attack they named Microtrick that bypasses authentication and hands over full administrator control.

If you're interested in more details, uh, please refer to the Aikido blog.

And the Polish CERT has published a detailed writeup regarding two vulnerabilities that Microtik recently patched in its RouterOS.

If you remember, I talked about this when it was first reported that there was a vulnerability in Microtik's RouterOS, specifically in the SH demon that is delivered as part of RouterOS, that allowed for an authentication bypass via SH and complete compromise of the router.

Now, Microtik did release patches, but no details about what exactly happened.

The Polish CERT is now filling this gap, and they discovered two distinct vulnerabilities.

Well, it turns out that that actually redirects the input, uh, to the SH demon from the client, so that's another part here of the authentication, uh, bypass.

Interesting writeup, and definitely if you're running Microtik, make sure you're up to date.

Uh, remember, this was also an SH demon that's unique to Microtik, so this is not a standard SH implementation like DropBear or OpenSH that they're deploying as part of RouterOS.

And this affected even our infrastructure and it was even our own workflow.

Uh, and, and lots of customers use it too, is, uh, there, there was a security vulnerability, like a 9.2 CVSS, uh, vulnerability in MikroTik's RouterOS.

And I love MikroTik, it's nothing against MikroTik.

Like this happens all the time to Cisco, Juniper, to everyone.

Okay.

How about network automation? It sounds like there's probably some good tie-in with network automation workflows and automation systems with Unimus.

Yeah, and, uh, even so w- with other examples of, of this CVE on, on MikroTik's RouterOS, right?

Mm-hmm.

Like, most, uh, networking equipment is typically built off Linux.

You've got some other folks like Cisco that have their own operating system, but I'm willing to bet that RouterOS, which is their operating system, is probably built on Linux or Unix.

Those have very standard libraries for handling SSH and handling SSH authentication, and this sounds like they rolled their own crypto or at least their own authentication library to introduce this issue.

'Cause I'm not aware of any, like, open SSH or OpenSSL or, like, any AuthD issues that could have caused this.

Yep.

Uh, another issue, CVE-2026-86060, which was a SSH session privilege, uh, manipulation issue.

Basically, uh, it sounds like RouterOS doesn't, uh, handle usernames that start with invalid characters during the SSH login well enough, and attackers can basically use a specially crafted username to gain additional privileges on the system.

When you look at the actual CVE and some of the IoCs they gave, um, it, they show, like, negative two as the user authenticating.