CERT Polska reports active exploitation of a two flaw SSH chain affecting MikroTik RouterOS. Devices with SSH reachable from public networks are at particular risk. Install a fixed release, then inspect the device for signs of unauthorized changes.
The situation
CERT Polska identified six RouterOS vulnerabilities and confirmed attacks using a chain it calls MikroTrick. The chain can give an unauthenticated attacker full control of a device when its SSH service is exposed to the internet.
MikroTik has released fixes. According to CERT Polska, the patched releases prevent the attacks it observed. Updating is the first priority, followed by a careful review of logs and configuration.
Three flaws to understand
The research covers several RouterOS components. These three findings explain much of the immediate risk:
SSH authentication bypass
Incomplete public key validation could let an attacker authenticate as a known user without that user’s private key.
SSH privilege manipulation
A crafted username could turn an SSH session into one with full administrative privileges.
Bandwidth-test memory exposure
A separate service flaw could disclose kernel memory or cause a remote restart.
Look beyond the patch
Updating closes the known vulnerabilities, but administrators also need to check whether a device was already changed. CERT Polska recommends reviewing unknown users, scripts, scheduler tasks, proxy servers, and tunnels.
The report highlights an unexpected high privilege account named ops and particular SSH log entries as possible indicators. RouterOS’s “Flagged” marker can identify selected suspicious changes; its absence does not prove the device is clean.
What to do now
- Update RouterOS. CERT Polska lists fixed versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Check the vendor’s bulletin for the release appropriate to your device.
- Review the device. Inspect logs, the Flagged marker, user accounts, scripts, scheduled tasks, and other configuration changes.
- Contain suspected compromise. Isolate the device and preserve logs and configuration before resetting it. Rebuild from a trusted configuration and rotate affected credentials.
If an update must be delayed, restrict exposed management services to trusted networks. This is a temporary measure; the update remains necessary.