Exposed MikroTik SSH hands over full administrative control without authentication

CERT Polska names two artifacts worth grepping for: highly privileged ops accounts nobody created on purpose, and account-creation log entries containing the string `ssh:-2@` ^[8]. Both live in the configuration, not the firmware. An update does not remove them, which is why CERT pairs immediate installation with a check for unauthorized configuration changes instead of treating the release as the end of the work ^[3].

RouterOS carries its own tell. Startup checks that spot suspicious configuration put the device into Flagged status, disable the offending entries and restrict some functions ^[5]. After updating, the logs and `/system/device-mode/print` show that status, and CERT's instruction is to inspect for unknown users, scripts and other unrecognized changes even when nothing was flagged ^[6]. Preserve the evidence before clearing Flagged ^[10].

The audit window is at least three days wide. Successful attacks go back to at least September 2 ^[2], the warning came out on September 5 ^[1], and that leaves three days of known exploitation before any operator could read about it ^[14]. It also puts the first known attacks one day ahead of the September 3 announcement of the 7.25beta3 and other initial fixes ^[15], while the 7.25beta3 changelog itself is dated September 2 ^[18]. The Hacker News compared those release announcements against CERT's timeline on September 6 and found the dates do not establish whether a fix was public before the attacks, so zero-day status is unverified ^[19].

Late updaters have a version to get right. 7.23.4 shipped the security update and introduced an IPv6 DHCP problem; 7.23.5 keeps the security update and fixes that regression ^[4].

Scope is bounded by configuration. MikroTik's own default firewall explanation says home devices block public access to management ports for as long as the default rules remain intact ^[9], so the reachable set is devices whose rules were removed or whose management services were deliberately published. Beyond that the picture is thin: The Hacker News's September 6 review of the warning found no victim count and no attacker identity ^[7], and it has put questions to CERT Polska and MikroTik ^[16].

Where the artifacts turn up, CERT's recovery is a rebuild. Isolate the router, preserve its logs and configuration, factory reset, rebuild from a trusted verified configuration rather than blindly restoring a backup off the suspect device, then change passwords, keys and other secrets ^[13].

What CERT has not published is the chain. It calls the two-flaw combination MikroTrick without saying which two vulnerabilities compose into administrative control or how ^[17]. The interim measures are drawn wider than the observed attack for that reason: turn off exposed services or restrict them to trusted management networks, particularly SSH, WWW/WWW-SSL and bandwidth-test ^[11], and do not initiate TLS connections or use RouterOS's built-in SSH clients from an unpatched device, restrictions CERT says cover the broader vulnerability set and do not replace the update ^[12].