MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key

Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internetexposed routers without a password SSH key or completed authentication The chain which CERT Polska calls MikroTrick combines an SSH statemachine flaw CVE202667279 with an argumentinjection bug in the RouterOS login process CVE202686060 Attack logs date to at