🛡️ Security

Argument Injection

A flaw (CWE-88) in which attacker-controlled input is passed into a command or program as arguments without neutralizing delimiters, so a value such as a username beginning with a dash is interpreted as an option rather than data. In RouterOS this allowed privilege escalation via a crafted SSH username (CVE-2026-86060).

📚 Deep Dive

Learn Article

How SSH Servers Get Tricked Into Skipping Authentication

SSH authentication bypasses rarely break the cryptography. Three real failure modes: doing the protocol steps out of order, verifying a signature incompletely, and trusting the shape of a username.

intermediate 5 min read

Back to Glossary