important · Wi-Fi — RouterOS
A RouterOS SSH identity named '-2' can replace its read-only policy mask with full administration.
Affects
MikroTik RouterOS, the operating system used by MikroTik routers and CHR virtual routers.
The path depends on an authentication backend accepting the literal username, after which PTY bytes replace fields carried through a trusted file descriptor.
Detail and 3 sources
Public code demonstrates full-policy writes, while RouterOS 7.23.4 rejects the username before the vulnerable child starts.