MikroTik RouterOS and Cloud Hosted Router

Risk Summary

Successful exploitation of this vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access.

CVEs (1)

Remediations

• No fix is currently available from MikroTik. Until a fix is available, MikroTik recommends that users adopt the following mitigations: Use a strong VPN or other additional protection layer if the API is exposed to public networks.
• Configure the unsuccessful-attempt time range (0.1 to 0.5 seconds) in /ip service for all services, including the API, once available.
• Connect initially from a trusted network (LAN) port only, then configure the router per your security requirements.
• Restrict/limit access to management services from untrusted networks.
• Apply firewall rules to control and restrict access to management services where possible.
• Use long, randomly generated passwords rather than weak or default-simple ones, to keep the brute-force search space impractically large.
• Keep the default randomly generated device password, or replace it with an equally strong one, since minimum complexity isn't enforced by default.
• Users are encouraged to reach out to MikroTik (https://mikrotik.com/support) for further support.

Affected Vendors

Affected Products (2)

Affected Sectors

Information Technology, Commercial Facilities