MikroTik's RouterOS has a near maximum severity bug: CISA urges updating ASAP

For the second time in less than a month, MikroTik devices have been found to be critically vulnerable to external attackers, who can break in without a password. Exposed MikroTik devices outnumber any other vendor on the internet, according to public scan data.

Critical vulnerabilities have been identified in RouterOS, which powers MikroTik routers, VPNs, switches, and other devices – 3.5 million of such devices are exposed on the open internet.

An anonymous researcher reported the bug directly to the US Cybersecurity and Infrastructure Security Agency (CISA).

The critical flaw, rated 9.8 out of 10 on the CVSS security score, affects the web management service.

If an attacker can reach it from the internet or from inside the network, they can craft a single malicious HTTP request and run code as root.

“The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request,” reads the advisory by CISA.

According to the CISA’s advisory, RouterOS versions earlier than 7.24 are affected, and users are advised to update to the latest version. The latest stable RouterOS release is 7.24.5.

The flaw is separate from another RouterOS authentication-bypass and privilege-escalation chain of critical vulnerabilities, dubbed MikroTrick, that have been exploited in the wild. These bugs allow unauthenticated remote attackers to compromise routers via exposed SSH.

MikroTik addressed SSH flaws in the stable RouterOS version 7.24.2 on September 3rd. Because that release is newer than 7.24, updating should fix both problems.

MikroTik hasn’t released a separate guidance addressing this specific vulnerability, tracked as CVE-2026-84411. Currently, this ID has been reserved, and the records have yet to be updated in the CVE program and the National Vulnerability Database maintained by NIST.

Millions of devices exposed

According to Censys scans, more than 367,000 hosts expose the RouterOS web interface with its default page title “RouterOS router configuration page.” Attackers can target them directly from the internet. However, it’s unclear how many of the IPs run vulnerable versions.

Users often leave services exposed directly to the internet due to misconfiguration. RouterOS updates are typically not installed automatically and require user action, which can leave many devices vulnerable.

There are many more MikroTik devices exposed on the internet – 2.8 million in total, mostly routers, according to Shadowserver Foundation.

This exposure is well above that of other router vendors such as Cisco (2.3M), Huawei (1.87M), and Fortinet (1.18M), as well as consumer-grade gear such as TP-Link (387K), DrayTek (391K), ASUS (294K), and Ubiquiti (262K).

Out of 6.4 million exposed routers, 2.7 million, or over 40%, are made by MikroTik.

CISA recommends that users minimize the network exposure of any connected systems, ensuring that they’re not accessible from the internet – sensitive services should be behind a firewall.

“When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also, recognize that a VPN is only as secure as the connected devices,” CISA said.

Currently, CISA has no reports of active exploitation attempts targeting the newly disclosed vulnerability. However, attackers using AI-driven automation can weaponize newly detected vulnerabilities within hours.

MikroTik is a Latvian network equipment manufacturer, and RouterOS is its proprietary Linux-based operating system. This hardware is popular for the value for money – MikroTik devices offer enterprise-level features at a fraction of the price charged by major vendors.