Hackers Exploit New MikroTik RouterOS Flaws to Seize Internet‑Facing Routers

Security researchers have confirmed that attackers are actively leveraging a pair of freshly disclosed vulnerabilities in MikroTik RouterOS to take control of routers that expose SSH services to the public internet.

The first flaw allows unauthenticated remote code execution when a specially crafted packet reaches the device. Once a foothold is gained, a second vulnerability enables privilege escalation, granting the attacker full root access and complete control over the router.

MikroTik equipment is widely deployed by internet service providers, small businesses, and enterprises for routing and traffic management. Because many administrators keep SSH open for remote configuration, the exposed service becomes a convenient entry point for malicious actors seeking to build botnets, intercept traffic, or pivot deeper into corporate networks.

MikroTik has issued patches that address both weaknesses and recommends that users apply the updates without delay. In addition, the vendor advises disabling SSH access from untrusted networks, restricting management interfaces with firewall rules, and ensuring that default credentials are changed to strong, unique passwords.

The incident highlights a broader trend of router firmware being targeted by sophisticated threat groups. As network devices become more integral to daily operations, vulnerabilities in their operating systems can have outsized effects, prompting security teams to prioritize timely patch management and reduce the attack surface by limiting exposed services.

Regulatory bodies and industry watchdogs are expected to issue advisories urging organizations to audit their MikroTik deployments. Experts say that continued monitoring of firmware updates and adopting a defense‑in‑depth strategy will be essential to mitigate the risk of further exploitation.