On 3rd September 2026, MikroTik quietly pushed Router OS 7.23.4 (long-term), 7.24.2 (stable) and 6.49.21 (v6), all flagged as important security updates with no details disclosed. The author argues that shipping patched binaries worldwide makes the diff itself the disclosure, so they pulled both versions and reversed the delta.

Three real bugs and two conditional chains emerged. One is a low-exponent RSA signature forgery leading to an mtget overflow. The other—matched to an active-exploitation support trace—is an SSH username of -2 reaching a legacy file-descriptor login transport, allowing an authenticated read-only session to supply its own full policy mask, yielding full RouterOS command execution and a path to mtget. The author notes they have not reproduced a credential-free way to make SSH accept literal user -2.

The changelog thread worth pulling was a single line: *) ssh - refactor SSH internal processes and improved system stability, present in 7.23.4, 7.24.2 and 6.49.21, absent from 7.23.3. RouterOS ships as NPK files carved into SquashFS, exposing nova binaries like sshd. Diffing dynamic symbol tables rather than raw bytes cuts straight to intent.