Six MikroTik RouterOS Flaws Enable Unauthenticated SSH Access and File Disclosure

MikroTik patched six vulnerabilities in RouterOS releases earlier than 6.49.21, 7.23.4, and 7.24.2. CERT Polska reported flaws affecting SSH authentication and RSA signature validation, WebFig file access, the btest service, and SSH login privilege handling. The issues can permit unauthenticated remote SSH command execution, disclosure of root-owned files that may contain credentials, kernel restarts, privilege escalation, and TLS server impersonation.

Organizations running affected RouterOS branches should upgrade immediately to RouterOS 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable). Administrators should review RouterOS flagged status and logs for compromise evidence, and investigate unauthorized accounts, scripts, scheduled tasks, firewall, VPN, DNS, NAT, and other configuration changes, particularly on internet-exposed devices.