{
  "story_id": "fcabc9fad4e09b35732c9e5f67687df6",
  "desk": "drm3",
  "revision": 2,
  "published_at": "2026-09-05T00:03:08.000Z",
  "content_hash": "e237ccf462ea645fc44232b733e27e89fce515fbdf8837127577000fadbd2861",
  "hash_basis": "sha256 over `headline\\ndek\\nprose`, plus `\\n` + the canonical citations JSON when any source is placed, plus `\\n#blog` for blogs",
  "basis": {
    "headline": "MikroTik RouterOS 7.23.4 Patch Fixes RSA Forgery and SSH Exploit",
    "dek": "Reverse engineering reveals MikroTik's silent RouterOS update fixes critical RSA and SSH vulnerabilities.",
    "prose": "On September 3, 2026, MikroTik released RouterOS versions 7.23.4, 7.24.2, and 6.49.21 as a silent security update without publishing detailed vulnerability information. [^1]\n\nThe security update addresses three distinct bugs: a low-exponent RSA signature forgery, an mtget memory corruption primitive, and an SSH vulnerability allowing full command execution. [^2] The MikroTik CRS804-4DDQ-hRM has a list price of $1295 but often sells at a street price of about $1100, making it under $0.70 per Gbps. [^3] The MikroTik CRS804-4DDQ-hRM switch has four 400GbE QSFP56-DD ports, providing a total of 1.6Tbps of switching capacity. [^4][^8]\n\nThe analyst determined that the username '-2' is interpreted as file descriptor 2 (stderr/PTY), which is then parsed as a policy mask via strtoul. [^5] The SSH exploit allows an authenticated read-only session to supply its own full policy mask and achieve full RouterOS command execution. [^6] The author's team has been running one MikroTik CRS804-4DDQ-hRM for several months as the RDMA network backend for an 8x NVIDIA GB10 cluster, and another for an NVIDIA GB300 Station cluster using DR4 optics. [^7]",
    "cited": "[{\"statement\":\"On September 3, 2026, MikroTik released RouterOS versions 7.23.4, 7.24.2, and 6.49.21 as a silent security update without publishing detailed vulnerability information.\",\"source\":\"Nick Pratley\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-05T00:03:08.000Z\",\"publisher_count\":1,\"sources\":[\"Nick Pratley\"]},{\"statement\":\"The security update addresses three distinct bugs: a low-exponent RSA signature forgery, an mtget memory corruption primitive, and an SSH vulnerability allowing full command execution.\",\"source\":\"Nick Pratley\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-05T00:03:08.000Z\",\"publisher_count\":1,\"sources\":[\"Nick Pratley\"]},{\"statement\":\"The MikroTik CRS804-4DDQ-hRM has a list price of $1295 but often sells at a street price of about $1100, making it under $0.70 per Gbps.\",\"source\":\"ServeTheHome\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T17:05:24.000Z\",\"publisher_count\":1,\"sources\":[\"ServeTheHome\"]},{\"statement\":\"The MikroTik CRS804-4DDQ-hRM switch has four 400GbE QSFP56-DD ports, providing a total of 1.6Tbps of switching capacity.\",\"source\":\"ServeTheHome\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T17:05:24.000Z\",\"publisher_count\":1,\"sources\":[\"ServeTheHome\"]},{\"statement\":\"The analyst determined that the username '-2' is interpreted as file descriptor 2 (stderr/PTY), which is then parsed as a policy mask via strtoul.\",\"source\":\"Nick Pratley\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-05T00:03:08.000Z\",\"publisher_count\":1,\"sources\":[\"Nick Pratley\"]},{\"statement\":\"The SSH exploit allows an authenticated read-only session to supply its own full policy mask and achieve full RouterOS command execution.\",\"source\":\"Nick Pratley\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-05T00:03:08.000Z\",\"publisher_count\":1,\"sources\":[\"Nick Pratley\"]},{\"statement\":\"The author's team has been running one MikroTik CRS804-4DDQ-hRM for several months as the RDMA network backend for an 8x NVIDIA GB10 cluster, and another for an NVIDIA GB300 Station cluster using DR4 optics.\",\"source\":\"ServeTheHome\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T17:05:24.000Z\",\"publisher_count\":1,\"sources\":[\"ServeTheHome\"]},{\"statement\":\"The four QSFP56-DD ports on the MikroTik CRS804-4DDQ-hRM can be split into 2x 200GbE QSFP56 ports and more, providing an easy path to 400GbE.\",\"source\":\"ServeTheHome\",\"instrument\":\"News\",\"claim_key\":null,\"published_at\":\"2026-09-03T17:05:24.000Z\",\"publisher_count\":1,\"sources\":[\"ServeTheHome\"]}]",
    "kind": "news"
  },
  "receipt_verify": "Ed25519 over the dot-joined string `slice_hash.cursor_from.cursor_to.view.view_version.row_count`; public_key and sig are base64url of the raw 32-byte key / 64-byte signature",
  "receipt": null,
  "receipt_note": "this revision predates receipt-keeping (before v0.37.0); the filed row lives in the record",
  "generation_chain": {
    "wire": {
      "stream": "fountain_news",
      "story_id": "69ee6db88e97a8efaf236fb74e050408",
      "thread_id": "fdf4faee99e6fafc6186e96a4697e63a",
      "thread_label": "MikroTik",
      "novelty": "UPDATE",
      "content_hash": "f73b6cf90d5ffd60a30145ecdc69899329ea94809e29dca2376b6f2f94170f86",
      "last_published_at": "2026-09-05T00:03:08.000Z",
      "read_receipt": {
        "slice_hash": "1c32200f02da81d2f4fae1e63fdeff66d61d30930dc085ec304ca43c2002f496",
        "cursor_from": "eyJ0cyI6IjIwMjYtMDktMDRUMjM6NTY6MjQuMDAwMDAwWiIsImlkIjoiZmJlYjk2OGVkMGRiMThiYjAxOWNhMGUyYTliY2VmZGYiLCJ2IjoiMSJ9",
        "cursor_to": "eyJ0cyI6IjIwMjYtMDktMDVUMDA6NDE6MDkuMDAwMDAwWiIsImlkIjoiZmQzNDkyZGMwZWEyYWMwOTg0NDE3Njc1NTMxMDY3ODgiLCJ2IjoiMSJ9",
        "view": "v_fountain_news",
        "view_version": "1",
        "row_count": 100,
        "window_days": 3,
        "bytes_scanned": 11524527,
        "credits": 8,
        "price_per_100_rows": 8,
        "sig": "rAN0L5850xQrp_pYcXUYWw7VZbMPJs03p-RxxiNrUBt85iiIHmjAvD7xDyNEvs0SjGazzkPEyXgMxf10KxfNAQ",
        "public_key": "bMUigy8O0jOnBxQ4Sc-5lwhIZ8LQVAhxMbR7qESVuUE",
        "signer_path": "lakehouse/data-extract/v1",
        "alg": "Ed25519",
        "signed": true
      },
      "compose": 3,
      "recomposed_at": "2026-09-05T18:55:54.540Z"
    },
    "written_at": "2026-09-05T06:24:10.661Z"
  },
  "cited_facts": [
    {
      "statement": "On September 3, 2026, MikroTik released RouterOS versions 7.23.4, 7.24.2, and 6.49.21 as a silent security update without publishing detailed vulnerability information.",
      "source": "Nick Pratley",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-05T00:03:08.000Z",
      "publisher_count": 1,
      "sources": [
        "Nick Pratley"
      ]
    },
    {
      "statement": "The security update addresses three distinct bugs: a low-exponent RSA signature forgery, an mtget memory corruption primitive, and an SSH vulnerability allowing full command execution.",
      "source": "Nick Pratley",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-05T00:03:08.000Z",
      "publisher_count": 1,
      "sources": [
        "Nick Pratley"
      ]
    },
    {
      "statement": "The MikroTik CRS804-4DDQ-hRM has a list price of $1295 but often sells at a street price of about $1100, making it under $0.70 per Gbps.",
      "source": "ServeTheHome",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T17:05:24.000Z",
      "publisher_count": 1,
      "sources": [
        "ServeTheHome"
      ]
    },
    {
      "statement": "The MikroTik CRS804-4DDQ-hRM switch has four 400GbE QSFP56-DD ports, providing a total of 1.6Tbps of switching capacity.",
      "source": "ServeTheHome",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T17:05:24.000Z",
      "publisher_count": 1,
      "sources": [
        "ServeTheHome"
      ]
    },
    {
      "statement": "The analyst determined that the username '-2' is interpreted as file descriptor 2 (stderr/PTY), which is then parsed as a policy mask via strtoul.",
      "source": "Nick Pratley",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-05T00:03:08.000Z",
      "publisher_count": 1,
      "sources": [
        "Nick Pratley"
      ]
    },
    {
      "statement": "The SSH exploit allows an authenticated read-only session to supply its own full policy mask and achieve full RouterOS command execution.",
      "source": "Nick Pratley",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-05T00:03:08.000Z",
      "publisher_count": 1,
      "sources": [
        "Nick Pratley"
      ]
    },
    {
      "statement": "The author's team has been running one MikroTik CRS804-4DDQ-hRM for several months as the RDMA network backend for an 8x NVIDIA GB10 cluster, and another for an NVIDIA GB300 Station cluster using DR4 optics.",
      "source": "ServeTheHome",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T17:05:24.000Z",
      "publisher_count": 1,
      "sources": [
        "ServeTheHome"
      ]
    },
    {
      "statement": "The four QSFP56-DD ports on the MikroTik CRS804-4DDQ-hRM can be split into 2x 200GbE QSFP56 ports and more, providing an easy path to 400GbE.",
      "source": "ServeTheHome",
      "instrument": "News",
      "claim_key": null,
      "published_at": "2026-09-03T17:05:24.000Z",
      "publisher_count": 1,
      "sources": [
        "ServeTheHome"
      ]
    }
  ],
  "note": "A signature proves who filed this and that it has not changed since. It never makes a claim true."
}