MikroTik RouterOS API lacks brute-force limits
MikroTik RouterOS and Cloud Hosted Router fail to rate-limit API authentication attempts, easing brute-force password guessing, with no fix yet available.
CISA published an ICS advisory detailing CVE-2026-16347, a weakness in MikroTik RouterOS and Cloud Hosted Router's API authentication handling. The affected systems do not enforce meaningful rate-limiting, account lockout, or source-based restrictions on failed login attempts. While some versions implement a fixed per-connection delay, this can be circumvented by opening concurrent sessions, allowing an attacker to sustain high-volume authentication attempts against the API.
The vulnerability, tracked under CWE-307 (Improper Restriction of Excessive Authentication Attempts), affects all versions of RouterOS and Cloud Hosted Router. MikroTik has not yet released a patch. Interim mitigations include restricting API exposure behind a VPN, configuring stricter unsuccessful-attempt time ranges once available, limiting initial configuration to trusted LAN connections, applying firewall rules to management services, and using long, randomly generated passwords to make brute-forcing impractical.
CISA notes the vulnerability is not remotely exploitable and no known public exploitation has been reported at this time. The issue was responsibly disclosed by Andre Santos of União Geek. Organizations running MikroTik equipment, widely deployed worldwide across IT and commercial facilities sectors, should apply the recommended compensating controls until an official fix is released.
Mentioned in this report
Detection guidance
Repeated Connections to MikroTik RouterOS API Ports Indicative of Brute Force
Detects network connection attempts to MikroTik RouterOS/CHR API ports (8728 TCP and 8729 TLS) which, per CVE-2026-16347, lack meaningful rate-limiting or lockout controls. A sustained high volume of connections to these ports from a single source (including many concurrent sessions opened to bypass the per-connection delay) indicates an active brute-force attempt against the API; this rule flags the traffic pattern and should be paired with a source-based threshold (e.g., more than 15-20 connection attempts per minute from one IP) enforced in the SIEM correlation layer, since Sigma process_creation/aggregation syntax cannot express that threshold directly. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Connections to MikroTik RouterOS API Ports Indicative of Brute Force
description: Flags TCP connections to the MikroTik RouterOS/CHR management API ports
(8728/8729). CVE-2026-16347 documents that RouterOS does not enforce rate-limiting,
account lockout, or source restrictions on failed API logins, and that a fixed per-connection
delay can be bypassed by opening many concurrent sessions. A burst of connections
to these ports from one source, especially many concurrent sessions rather than
a single sustained one, is consistent with brute-force attempts exploiting this
weakness. This rule matches on the distinctive destination ports; analysts should
correlate with connection-count-per-source thresholds in their SIEM to reduce noise,
since that aggregation cannot be encoded in the Sigma condition itself.
tags:
- attack.credential_access
- attack.t1110
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort:
- 8728
- 8729
filter_established_mgmt:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_established_mgmt
falsepositives:
- Legitimate WinBox/API management sessions initiated by admin workstations on trusted
internal subnets
- Monitoring or automation tools polling the RouterOS API for metrics or configuration
management
- VPN-terminated management traffic that is expected to reach the API from a jump
host
level: low
id: c83c723e-194e-541a-93f4-e3a3a066f939
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-05
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free