Topic
The practice of protecting internet-facing routers, switches and firewalls from flaws in their vendor-specific firmware and management interfaces.
CERT Polska disclosed MikroTrick, a chain of two RouterOS flaws that gives unauthenticated admin on routers whose SSH faces the internet. Attacks were already under way at disclosure. Reachable SSH is the one condition the chain needs.
Reality
Nebraska Attorney General Mike Hilgers led 21 states in asking the FCC to address TP-Link's China ties before it approves new router models. Nebraska's office puts TP-Link at 60 percent or more of the US retail market for Wi-Fi systems and small-office routers.
Reality
Florida, Iowa, Montana and Nebraska sued TP-Link, saying it misled buyers about router security and its ties to China. For anyone buying routers, the federal ban that already blocks TP-Link's new models from US sale is the constraint that applies now.
Perspective Coverage
8 publishersReality
D-Link's DIR-822A firmware A_101 has two critical flaws, scored 9.9 and 10.0, with public proof-of-concept code and no fixed release yet. Until D-Link ships a build, owners are left isolating the router from untrusted networks or planning its replacement.
Reality
CERT Polska dated successful attacks to at least September 2 and published its warning on September 5, so operators who deferred the RouterOS update have three days of configuration changes to read as well as a patch to install.
Perspective Coverage
8 publishersReality
VulDB scored CVE-2026-86296 at 10.0 because a crafted DHCP request reaches the DIR-822A's udhcpcd with no credentials and no user interaction, while D-Link is still working out which hardware revisions are affected.
Perspective Coverage
3 publishersReality
CERT Polska's breakdown of the September RouterOS compromises names two bugs, CVE-2026-67279 and CVE-2026-86060, and the forum logs that match the chain start on September 2, a day before MikroTik shipped fixes.
Reality