https://sijisu.eu/tags/0day/Recent content in 0day on SijisuHugoen-usFri, 25 Sep 2026 13:37:00 +0100https://sijisu.eu/posts/3-mikrotik-preauth-rces/Fri, 25 Sep 2026 13:37:00 +0100https://sijisu.eu/posts/3-mikrotik-preauth-rces/<p>This is the story of GPT 5.6 Sol, DeepSeek v4 Flash 0731, and me finding three pre-authentication RCEs in MikroTik RouterOS.</p> <h2 id="tldr">TL;DR</h2> <ul> <li>LLMs found <strong>2 pre-auth exploitable bugs on the MikroTik RouterOS 7.23.3</strong>, both resulting in RCE under some conditions <ul> <li>DHCP relay buffer overflow</li> <li>WebFig auth bypass resulting in file upload, resulting in delayed RCE</li> </ul> </li> <li>they achieved this without any special harnesses, <strong>just a /goal prompt</strong> inspired by the one that found wp2shell</li> <li>the SSH RCE exploited in the wild was not found in this research, because it was not included in the pre-auth scope during the initial run <ul> <li>ensuring <em>all</em> vulnerabilities have been found is still hard</li> </ul> </li> <li>after MikroTik patched we found <strong>another pre-auth RCE</strong> utilizing a session takeover <ul> <li>AES-CTR vulnerable in WebFig resulting in unauthenticated file upload</li> </ul> </li> <li>GPT 5.6 Sol is <strong>extremely capable</strong> <ul> <li>you don&rsquo;t need a harness, just a manager who &ldquo;kinda knows what he is doing&rdquo;</li> </ul> </li> <li>you should <strong>update everything as soon as possible</strong> every time <ul> <li>every outdated software should be automatically considered exploitable by <em>anyone</em></li> <li>every updated software only a little bit less exploitable</li> </ul> </li> <li>this is still only the beginning, I&rsquo;m certain there are <strong>many more, even worse, bugs to be discovered</strong></li> </ul> <h2 id="deepseek-v4-flash-attempt">Deepseek v4 Flash attempt</h2> <p>When DeepSeek v4 Flash 0731 came out at the beginning of August, it seemed almost <em>free</em> to use - it barely consumed any usage while still being quite powerful.</p>