MikroTik RouterOS API lacks brute-force limits
MikroTik RouterOS and Cloud Hosted Router fail to rate-limit API authentication attempts, easing brute-force password guessing, with no fix yet available.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory detailing CVE-2026-16347, a weakness in MikroTik RouterOS and Cloud Hosted Router's API authentication handling. The affected systems do not enforce meaningful rate-limiting, account lockout, or source-based restrictions on failed login attempts. While some versions implement a fixed per-connection delay, this can be circumvented by opening concurrent sessions, allowing an attacker to sustain high-volume authentication attempts against the API.
The vulnerability, tracked under CWE-307 (Improper Restriction of Excessive Authentication Attempts), affects all versions of RouterOS and Cloud Hosted Router. MikroTik has not yet released a patch. Interim mitigations include restricting API exposure behind a VPN, configuring stricter unsuccessful-attempt time ranges once available, limiting initial configuration to trusted LAN connections, applying firewall rules to management services, and using long, randomly generated passwords to make brute-forcing impractical.
CISA notes the vulnerability is not remotely exploitable and no known public exploitation has been reported at this time. The issue was responsibly disclosed by Andre Santos of União Geek. Organizations running MikroTik equipment, widely deployed worldwide across IT and commercial facilities sectors, should apply the recommended compensating controls until an official fix is released.
Mentioned in this report
Detection guidance
Repeated Connections to MikroTik RouterOS API Ports Indicative of Brute Force
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects network connection attempts to MikroTik RouterOS/CHR API ports (8728 TCP and 8729 TLS) which, per CVE-2026-16347, lack meaningful rate-limiting or lockout controls. A sustained high volume of connections to these ports from a single source (including many concurrent sessions opened to bypass the per-connection delay) indicates an active brute-force attempt against the API; this rule flags the traffic pattern and should be paired with a source-based threshold (e.g., more than 15-20 connection attempts per minute from one IP) enforced in the SIEM correlation layer, since Sigma process_creation/aggregation syntax cannot express that threshold directly. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Connections to MikroTik RouterOS API Ports Indicative of Brute Force
description: Flags TCP connections to the MikroTik RouterOS/CHR management API ports
(8728/8729). CVE-2026-16347 documents that RouterOS does not enforce rate-limiting,
account lockout, or source restrictions on failed API logins, and that a fixed per-connection
delay can be bypassed by opening many concurrent sessions. A burst of connections
to these ports from one source, especially many concurrent sessions rather than
a single sustained one, is consistent with brute-force attempts exploiting this
weakness. This rule matches on the distinctive destination ports; analysts should
correlate with connection-count-per-source thresholds in their SIEM to reduce noise,
since that aggregation cannot be encoded in the Sigma condition itself.
tags:
- attack.credential-access
- attack.t1110
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort:
- 8728
- 8729
filter_established_mgmt:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_established_mgmt
falsepositives:
- Legitimate WinBox/API management sessions initiated by admin workstations on trusted
internal subnets
- Monitoring or automation tools polling the RouterOS API for metrics or configuration
management
- VPN-terminated management traffic that is expected to reach the API from a jump
host
level: low
id: c83c723e-194e-541a-93f4-e3a3a066f939
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-05
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs