Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
CERT Polska warns attackers exploit internet-exposed MikroTik SSH for unauthenticated full admin control; attacks observed since at least September 2.
CERT Polska warned on September 5 that attackers exploit MikroTik routers with internet-reachable SSH to gain full administrative control without authentication, calling the two-flaw combination 'MikroTrick'. Successful attacks date to at least September 2; no victim count or attacker identity was disclosed. MikroTik shipped fixed RouterOS releases: 6.49.21, 7.23.4 (with 7.23.5 fixing an IPv6 DHCP regression), 7.24.2, and 7.25beta3. CERT recommends immediate updates, checking for unauthorized configuration changes, and restricting SSH, WWW/WWW-SSL, and bandwidth-test services on unpatched devices.
- Two-flaw chain ('MikroTrick') yields unauthenticated full admin access via exposed SSH.
- Fixed releases: RouterOS 6.49.21, 7.23.4/7.23.5, 7.24.2, and 7.25beta3.
- CERT advises restricting SSH, WWW/WWW-SSL, and bandwidth-test and avoiding outbound SSH/TLS from unpatched devices.
- Compromise signs: Flagged status, ssh:-2@ in account-creation logs, unexpected privileged ops accounts.
- Zero-day status unverified; 7.25beta3 changelog dated September 2, fixes announced September 3.
- Vendors
- MikroTik
- Products
- RouterOS
- Organizations
- MikroTikCERT PolskaThe Hacker News
- Countries
- Poland
From the original article
2 min read at thehackernews.com
Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without authentication, according to CERT Polska's attack warning, published on September 5. Successful attacks date to at least September 2. The Hacker News’s September 6 review of the warning found no victim count or
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.