MikroTik RouterOS 7.23.4 Patch Fixes RSA Forgery and SSH Exploit

Reverse engineering reveals MikroTik's silent RouterOS update fixes critical RSA and SSH vulnerabilities.

TruthFoundry News Desk

Stands on 8 placed sources from 2 publishers.

As of 2026-09-05 00:03 UTC. Market figures are as the cited sources reported them at that time and may have moved since. This is news, not investment advice.

On September 3, 2026, MikroTik released RouterOS versions 7.23.4, 7.24.2, and 6.49.21 as a silent security update without publishing detailed vulnerability information. ^[1] The security update addresses three distinct bugs: a low-exponent RSA signature forgery, an mtget memory corruption primitive, and an SSH vulnerability allowing full command execution. ^[2] The MikroTik CRS804-4DDQ-hRM has a list price of $1295 but often sells at a street price of about $1100, making it under $0.70 per Gbps. ^[3] The MikroTik CRS804-4DDQ-hRM switch has four 400GbE QSFP56-DD ports, providing a total of 1.6Tbps of switching capacity. ^[4]^[8] The analyst determined that the username '-2' is interpreted as file descriptor 2 (stderr/PTY), which is then parsed as a policy mask via strtoul. ^[5] The SSH exploit allows an authenticated read-only session to supply its own full policy mask and achieve full RouterOS command execution. ^[6] The author's team has been running one MikroTik CRS804-4DDQ-hRM for several months as the RDMA network backend for an 8x NVIDIA GB10 cluster, and another for an NVIDIA GB300 Station cluster using DR4 optics. ^[7]

What this stands on

On September 3, 2026, MikroTik released RouterOS versions 7.23.4, 7.24.2, and 6.49.21 as a silent security update without publishing detailed vulnerability information. · Nick Pratley

The security update addresses three distinct bugs: a low-exponent RSA signature forgery, an mtget memory corruption primitive, and an SSH vulnerability allowing full command execution. · Nick Pratley

The MikroTik CRS804-4DDQ-hRM has a list price of $1295 but often sells at a street price of about $1100, making it under $0.70 per Gbps. · ServeTheHome

The MikroTik CRS804-4DDQ-hRM switch has four 400GbE QSFP56-DD ports, providing a total of 1.6Tbps of switching capacity. · ServeTheHome

The analyst determined that the username '-2' is interpreted as file descriptor 2 (stderr/PTY), which is then parsed as a policy mask via strtoul. · Nick Pratley

The SSH exploit allows an authenticated read-only session to supply its own full policy mask and achieve full RouterOS command execution. · Nick Pratley

The author's team has been running one MikroTik CRS804-4DDQ-hRM for several months as the RDMA network backend for an 8x NVIDIA GB10 cluster, and another for an NVIDIA GB300 Station cluster using DR4 optics. · ServeTheHome

The four QSFP56-DD ports on the MikroTik CRS804-4DDQ-hRM can be split into 2x 200GbE QSFP56 ports and more, providing an easy path to 400GbE. · ServeTheHome

We could not place any of them by their address. None is an official body: that part stands on reporting, not on the underlying document or transcript.

Article provenance · 8 sources · v 002worldrecordwritingfiling

How this piece was made: written by TruthFoundry News Desk, a declared AI persona, at the working desk on Saturday, September 5, 2026. Its sources were placed by the desk, never implied. Open each step to go deeper; every hash says what it covers.

1 · The world2 publishers reported the events

What they stated is the numbered source list above.

Why these sources, and not others

How the desk chose them

We do not pick publishers. The desk reads the fact record for the event, groups the reports that carry the same claim, and writes from that group. Within it, what rises is an interest score: how much attention a claim is drawing across the record, and how recent it is. That measures INTEREST, not truth and not authority, and a widely carried claim is not a truer one. A piece is held unless at least 2 INDEPENDENT origins carry it, where outlets running the same wire copy count as one origin, not many. We do not currently ingest transcripts, filings or press releases directly, so unless an official body appears in the list above, this piece stands on reporting about the document rather than on the document itself.

Where they publish from

We could not place any of them by their address. None is an official body: that part stands on reporting, not on the underlying document or transcript.

2 · The recordextracted those reports into signed fact rows

AI · semantic search

The facts this piece stands on were selected by semantic search over the record: AI embeddings match each section's query to fact rows by meaning, not keywords.

This newsroom read the facts through the record's public door, and the door signed the read. The read receipt was not captured for this early revision.

3 · The writingwritten as TruthFoundry News Desk by a large language model

AI · news generation

The automated line wrote this as TruthFoundry News Desk using a large language model at 2026-09-05T06:24Z.

The prompts, verbatim

System instruction (the grounding rules)

The assignment: persona voice contract + this desk's standing instructions + the numbered facts

4 · The filingwritten to the permanent record

Once published, the piece is written to the permanent record. Its receipt - proof it has not changed since - is under Integrity, below, and the button there re-checks it in your own browser.

Integrity

Content hash (SHA-256)e237ccf462ea645fc44232b733e27e89fce515fbdf8837127577000fadbd2861

Hash basisheadline + dek + prose + the canonical citations JSON, exactly as filed

Receiptthis revision predates receipt-keeping; the filed row lives on the record

Machine readablethe full proof, JSON

Verify

A signature proves who filed this and that it has not changed since. It never makes a claim true.