MikroTrick: RouterOS Under Active Attack & Why Disclosure Matters | Streaming Security EP1
Source: YouTube · Lawrence Systems · published Sep 8, 2026 · 45:11
This episode covers chained MikroTik SSH vulnerabilities and what they reveal about responsible disclosure, vendor programs, and patching priorities 0:10.
Key Takeaways:
• Chained CVEs (SSH auth bypass + privilege escalation) allowed full takeover of ~122K exposed MikroTik devices 2:20
• SSH isn't broken — poor vendor implementation was; the real error was exposing management interfaces publicly 5:01
• CIS Control 16 applies to code-producing vendors: secure development (16.1), accepting vulnerability reports (16.2), root cause analysis (16.3) 10:41
• SonicWall lawsuit: unencrypted backups (CIS 3.11 failure) allegedly pulled by incrementing serial numbers, fueling a fintech ransomware attack 17:59
• Delayed disclosure details (Ubiquiti) are a legitimate cooling-off period letting users patch before exploits spread 25:44
• Know your assets, prioritize edge devices for daily patch review, and ask vendors about disclosure/bug bounty programs 34:57
With PoC-to-exploitation timelines now measured in hours, patching internet-facing devices fast is no longer optional 40:02.
Sources:
- 0:10 Intro: MikroTik SSH vulnerabilities and responsible disclosure
- 2:20 Chained CVEs and 122K exposed devices
- 5:01 SSH isn't broken; poor implementation is the issue
- 10:41 CIS Control 16 breakdown
- 17:59 SonicWall backup exposure and CIS 3.11
- 25:44 Ubiquiti delayed disclosure defended
- 34:57 Takeaways: inventory and vendor questions
- 40:02 Prioritize edge device patching
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
We are live episode one because we're proper people that started at zero for the first episode. [laughter] Oh man. So Maker is in the news for well things and stuff and some SSH vulnerabilities and I'm not here to bash on them. We are here to talk about responsible disclosure because people have a lot of confusion around this as a topic and uh something that's you know I I I see it flying around like when should or when you shouldn't disclose things and why you should and boy the exact happenings have just happened to make this topic we already picked this as a topic and the cyber security world always provides examples of good good uh security topics or poor security topics whichever whichever e either way a lot of people open up some things they should know So Matt's going to join us as …