Attackers Take Over MikroTik Routers via Unauthenticated SSH

Attackers are taking over MikroTik routers by connecting to an internet-facing secure shell (SSH) service that requires no password, according to a warning from CERT Polska published on September 5. SSH is a common way to remotely manage a device through an encrypted text session. When that service is reachable from the public internet and no authentication is enforced, an attacker can gain full administrative control of the router. CERT Polska reports that successful attacks date back to at least September 2. A September 6 review by The Hacker News found no number of affected victims and no information about who is behind the attacks.

According to the affected ranges reported by CERT and the fixes listed by MikroTik, the affected RouterOS versions include releases from 6.0.0 up to versions below 6.49.21, releases from 7.0.0 up to versions below 7.23.4, and releases from 7.24 up to versions below 7.24.2. The initial fixed releases are 6.49.21, 7.23.4, and 7.24.2. MikroTik recommends RouterOS 7.23.5 on the long-term channel for the 7.23 branch, because 7.23.5 fixes an IPv6 DHCP (Dynamic Host Configuration Protocol) problem that was introduced in 7.23.4 while keeping the security update. For the development channel, the fix is 7.25beta3; CERT's disclosure does not list an affected development range. Official RouterOS downloads are available from the vendor.

MikroTik's default firewall guidance explains that home devices block public access to management ports while the default firewall rules remain intact. This suggests that affected devices likely had those protections changed or disabled, but the warning does not state that every compromised device had the default firewall removed. CERT Polska's advisory says that the fixes prevent the observed attacks and that administrators should install them immediately, then check for any unauthorized configuration changes. Until the update can be installed, CERT recommends turning off exposed services or restricting access to trusted management networks, especially for SSH, WWW/WWW-SSL (the router's web interface), and bandwidth-test. The advisory also advises against starting TLS (Transport Layer Security) connections or using the built-in SSH clients from an unpatched device. These temporary restrictions cover a broader set of vulnerabilities and do not replace the update.

After updating, administrators should check the logs and run the RouterOS command /system/device-mode/print to inspect a status that MikroTik calls Flagged. According to the vendor's Flagged status guidance, RouterOS flags a device when its startup checks detect suspicious configuration, disables those entries, and restricts certain functions. CERT says not to clear the Flagged status before you have preserved evidence and completed your analysis. Even if no warning appears, CERT advises inspecting the configuration for unknown users, scripts, and other unrecognized changes. CERT specifically points to unexpected highly privileged ops accounts and account-creation log entries containing ssh:-2@ as signs that should be investigated.

If the warning, logs, or configuration indicate that the router was compromised, CERT Polska recommends a set of recovery steps. First, isolate the router from the network and preserve its logs and configuration before resetting it. CERT has published a preservation guide in Polish that explains how to export and download those files. Second, restore factory settings and rebuild the device using a trusted, verified configuration; do not simply restore a full backup from the potentially compromised router. Third, change all passwords, keys, and other secrets that were in use on the device.

CERT Polska calls the reported two-flaw combination MikroTrick. The Hacker News compared CERT's warning and vulnerability disclosure on September 6 and found that neither document explicitly identifies which two vulnerabilities form the observed chain or explains how they combine to give administrative control. The 7.25beta3 release notes are dated September 2, while the beta and other initial fixes were announced on September 3. The Hacker News compared those release announcements with CERT's attack timeline. Those dates do not establish whether a fix was publicly available before the attacks began, so the zero-day status of the flaws remains unverified. The Hacker News has contacted CERT Polska and MikroTik for comment.

For teams that manage multiple network devices and need help reviewing how management ports are exposed or planning updates such as the RouterOS fixes described here, AEU-I, AEU Group's security-first IT and infrastructure consulting practice, can assist with hardening routers and other network equipment.

Until the update is installed, the safest action is to remove the router from the public internet or restrict management access to a trusted local network, exactly as CERT Polska advises. The same caution applies to any internet-facing device with remote administration enabled: apply the vendor's security update, then verify that no unauthorized changes remain.