Roskomnadzor Orders ISPs to Fix MikroTik Gear or Cut Off Your Internet
The masterminds at Roskomnadzor have decided that if your MikroTik router is too lazy to update itself, your internet privileges are getting revoked. It is a stunning display of security theater where the state turns ISPs into glorified IT support staff.
The GRChTs—the digital muscle behind Roskomnadzor—has officially issued a mandate to Russian ISPs: patch your MikroTik routers or face the consequences. This follows a discovery by CERT Polska regarding a cluster of nasty bugs in RouterOS that could let an attacker waltz into your admin console without even needing a password.
Specifically, CVE-2026-67276 lets hackers bypass SSH authentication by faking RSA keys, while CVE-2026-86060 allows anyone to snag full admin privileges by simply typing in a weird username. When you combine these with CVE-2026-67277, which lets people crash your router just for kicks, you have the perfect recipe for a total network meltdown.
The regulator is demanding that operators warn their users to update their gear. If you ignore the prompt for a week, the ISP is instructed to throttle or block your ports, effectively turning your high-speed connection into a glorified dial-up modem until you click that 'update' button.
It is truly heartwarming to see a government agency treat home router firmware with the same tactical urgency as a state border dispute. Nothing says 'secure network infrastructure' quite like forcing ISPs to play nanny to 100,000 routers that have no business being exposed to the wild, open web in the first place.
Source: The Hacker News
Comments
Help shape the next version: Add context or suggest a correction. AI review can add points toward a rewrite. Reviews and updates may take time; a full meter does not guarantee a new version.