Firewalling RouterOS SSH to a management network removes MikroTrick's precondition

Reachability is the gate. The chain starts in the SSH public-key verification path, and the dev.to writeup puts the consequence plainly: a RouterOS device that is not reachable over SSH from the internet cannot be attacked through this chain, regardless of its software version ^[5]. The statement is about the transport, so it holds for every build. Restrict SSH, WebFig and the bandwidth-test service to a trusted management network and the precondition is gone ^[6].

The writeup advises checking logs for SSH logins using the username `-2`, and auditing local users for unauthorized accounts such as `ops` ^[16]. CVE-2026-86060 is an argument delimiter injection ^[3]. A login name that starts with a dash parses as an option once it reaches a command line, which fits that bug class ^[21]. The log audit is a string search for a username that is really a flag.

On the measurement side, the ZoomEye data was collected on September 19, 2026, fourteen days after the advisory ^[19]. The writeup is explicit about the limits. Fingerprint matching is not version detection, so a record matching `app="RouterOS"` shows that the service identifies as RouterOS and not whether it runs the patched 7.24.2 or an older release ^[11]. The totals describe the ZoomEye index, which samples and retains what it has observed, not a complete census ^[12]. And the port 8291 count is Winbox, a different management surface from SSH ^[8]. The article lists its query strings but does not include the numbers they returned ^[10].

The fixed versions are 6.49.21, 7.23.4, 7.24.2 and 7.25beta3, and 7.23.5 was released on September 4, a day before the disclosure ^[14][20]. An inventory check therefore has to match five build numbers across two major trains, 6.x and 7.x ^[22]. Upgrading also installs a detector: patched builds add a `Flagged` self-check that marks a device if it finds known tampering artifacts on boot ^[15].

That leaves the population number. For the widely cited 122,000 to mean anything about a specific estate, the counted devices would have to be ones you own, and SSH would have to answer from outside. No fingerprint query establishes the second condition ^[9][11]. The writeup attributes the figure to public reporting and describes it as exposed and potentially vulnerable instances. It does not present them as confirmed intrusions ^[13].