MikroTik RouterOS SSH exposure enables unauthenticated admin takeover since September 2

CERT Polska documented the MikroTrick campaign targeting RouterOS versions 6.0–6.49.20, 7.0–7.23.3, and 7.24–7.24.1. Successful intrusions grant persistent root-level access, allowing configuration changes, script injection, and traffic interception. The vector requires only that the SSH service remains reachable from the public internet, a condition that persists on devices whose default firewall rules have been altered or never applied.

MikroTik’s own documentation states that home routers should block management ports by default, yet procurement records and Shodan telemetry show hundreds of thousands of units with port 22 open. The absence of CVE identifiers or detailed patch notes leaves operators unable to verify whether the fixes in 6.49.21, 7.23.4, and 7.24.2 close both flaws or merely one. This opacity mirrors prior RouterOS incidents where partial advisories delayed remediation.

Home users and small businesses bear the brunt because they rarely maintain separate management networks or monitor for unauthorized accounts ending in ssh:-2@. The same exposure pattern appears in other consumer-grade routers whose vendors similarly prioritize feature velocity over hardened defaults. Until authentication is enforced at the protocol level regardless of firewall state, these devices will remain low-cost entry points for botnets and data exfiltration.

Operators must apply the listed releases immediately, then export logs and configuration before any factory reset. Continued scanning for new MikroTrick variants is expected within the next 14 days.