MikroTik SSH Rekeying and Username Flaws Chain Into Unauthenticated RouterOS Admin Access

Attackers can combine two MikroTik RouterOS vulnerabilities to gain administrator-level access to exposed routers without a password. Security researchers at Bishop Fox reproduced the attack chain and found artifacts on real devices that suggest attackers exploited the flaws before public fixes became available. The issue is especially serious because routers handle traffic between internal networks and the internet. A compromised MikroTik device could allow attackers to…