Active Exploitation of MikroTik RouterOS via SSH

The Netherlands National Cyber Security Centre (NCSC) has issued an alert regarding multiple serious vulnerabilities in MikroTik RouterOS that are currently being actively exploited. The threat actor activity specifically targets routers that have SSH services exposed directly to the internet. Successful exploitation of these vulnerabilities allows unauthorized remote attackers to gain full administrative control over the affected network device.

Impacts of a successful compromise include complete network takeover, the ability to intercept or redirect sensitive data traffic, and the potential for total loss of network connectivity. These routers are frequently utilized in enterprise and internet service provider environments, meaning that a compromise could cause widespread service disruption and significant business process failure. MikroTik has released patches in versions 6.49.21, 7.23.4, and 7.24.2 to address the vulnerabilities.

Impact

Successful exploitation results in full administrative control over the router. In enterprise and ISP environments, this grants attackers the ability to intercept organizational data, pivot into internal network segments, or perform denial-of-service attacks by disabling connectivity. Organizations failing to patch are at high risk of total infrastructure compromise.

Recommendation

• Upgrade MikroTik RouterOS to version 6.49.21, 7.23.4, or 7.24.2 immediately to mitigate the underlying vulnerabilities.
• Disable direct internet-facing SSH access on all router interfaces.
• Restrict administrative access to SSH services by implementing VPN-only access or IP-based whitelisting.
• Audit logs for unauthorized SSH sessions or unexpected configuration changes on all public-facing RouterOS devices.