MikroTik SSH Auth Bypass Under Active Exploit
MikroTik has patched an already-exploited SSH authentication bypass; admins should assume compromise and check for attacker-added accounts.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
SANS ISC reports that MikroTik released an emergency patch for a critical SSH authentication bypass vulnerability that is already being actively exploited in the wild. Attackers exploiting the flaw have been observed adding new administrative accounts to compromised RouterOS devices, a persistence technique intended to maintain access even after the device is patched. Because the vulnerability allows bypassing SSH authentication entirely, any exposed and unpatched MikroTik device should be treated as potentially compromised rather than merely vulnerable.
MikroTik's patch includes a detection mechanism that will mark affected devices with a 'Flagged' status if signs of prior compromise are found, giving defenders a built-in indicator to check post-patch. Given the scale of MikroTik device deployment (particularly RouterOS-based routers commonly used by ISPs, small businesses, and home users), and the fact that exploitation is already underway, this represents an urgent, actively exploited threat to internet-facing network infrastructure.
Defenders running MikroTik RouterOS devices should apply the vendor patch immediately, review the device's user account list for any unauthorized or unrecognized accounts added by attackers, check for the 'Flagged' compromise status after patching, and restrict SSH access to trusted management networks where possible. Full technical details are available in MikroTik's security advisory.
Source reporting: https://isc.sans.edu/diary/rss/33314
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs