Two Critical RouterOS Flaws Allow Unauthenticated Admin Access to Edge Devices

·23 views

MikroTik RouterOS was found to contain two serious vulnerabilities, CVE-2026-67279 and CVE-2026-86060, patched on 3 September 2026, that together allow attackers to gain full administrative control without a password or key. The first flaw mishandles SSH rekeying during authentication, while the second misinterprets a hyphen-prefixed username as a command option, bypassing login checks entirely. Because RouterOS devices typically sit at the network boundary, exploitation can enable traffic interception, firewall modification, VPN key theft, and persistent account creation. Observed attack activity included creation of a privileged SSH account and exfiltration of device diagnostic files to an external address. Fixes are available in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, and administrators are urged to patch promptly, audit accounts, rotate credentials, and restrict public management access.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

UIDAI Unveils Lighter Sub-AUA/Sub-KUA Route for Low-Volume Aadhaar Users

On 29 September 2026, UIDAI announced five initiatives at Aadhaar Samvaad in Kolkata, including a new LITE framework for Sub-AUAs and Sub-KUAs. Sub-AUAs and Sub-KUAs access Aadhaar services through an existing AUA or KUA, which handles Yes/No authentication and e-KYC respectively. The LITE framework is intended to simplify and speed up onboarding for entities with lower authentication volumes, including government and eligible non-government bodies. Under existing rules, AUAs and KUAs need UIDAI approval before appointing a Sub-AUA or Sub-KUA, and they remain jointly liable for compliance. The article notes that UIDAI has not yet released full details of the LITE route, so regulated entities such as lenders and fintechs are advised to prepare while awaiting clarification.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Money Tracker app explains bill import without bank logins, using confirm-before-save

The developer of Money Tracker, an expense app for Android and iOS, describes its statement and bill import feature, which is available on the Premium tier. Users export a file such as a PDF or CSV from their bank or card issuer, then upload it to the app, which parses it into draft entries. Each draft must be reviewed and confirmed by the user before it is saved to their records. The developer stresses that the app never asks for bank credentials and does not maintain ongoing connections to accounts, unlike bank-sync services. The post presents this as a narrower, more controlled alternative to automatic open-banking sync.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Contact form shows success but enquiries go missing: how to trace one test message

A contact form can display a success message while the enquiry never reaches the team's mailbox. The recommended approach is to follow a single identifiable test submission through the form, the sending route, and the receiving mailbox, rather than changing the mail plugin or DNS first. A successful wp_mail() return only means the sending method processed the request without error, not that the recipient got the email. Form plugins may also have demo or skip-mail settings that show success without sending, so these should be checked. Each finding, such as no matching record, a sending error, or provider acceptance, points to a different next check.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Handling Email API Timeouts in Order Report Delivery

An email API timeout should be treated as an unknown delivery state rather than a confirmed failure, since the server may have accepted the message even though no response arrived. The article recommends recording an idempotency key before the first send attempt and separating connection, request, and delivery deadlines to pinpoint where delays occur. Attachment generation should move out of the synchronous request path, with the web request only enqueuing a durable job that a worker processes. Retries are only safe when the receiver supports idempotency or the outcome can be reconciled, otherwise duplicate emails may be sent. Deadlines should be chosen per workflow phase and kept in configuration.

0 comments Read more at DEV Community