Executive brief
MikroTik RouterOS, the operating system used in MikroTik routers and cloud-based networking hardware, lacks effective protections against repeated login attempts on its management interface. This allows an attacker on the same local network to perform high-speed automated password guessing without being blocked or slowed down. If successful, an attacker could gain full administrative control over the router, potentially leading to data interception, network outages, or unauthorized access to the internal corporate network.
Technical details
MikroTik RouterOS is vulnerable to improper restriction of excessive authentication attempts (CWE-307) within its API service. The system fails to enforce meaningful rate-limiting, account lockouts, or source-based restrictions for failed logins. While some versions implement a fixed per-connection delay, this defense can be bypassed by initiating multiple concurrent sessions to maintain a high volume of attempts. An attacker with adjacent network access can exploit this to conduct brute-force attacks against administrative credentials. As of the advisory date, no official patch is available, and users are advised to restrict API access to trusted networks and use strong, complex passwords.
Affected products
- MikroTik RouterOS All versions
- MikroTik Cloud Hosted Router All versions
Timeline
- 2026-07-28: disclosed: Initial publication of ICS-CERT advisory ICSA-26-209-05
- 2026-07-28: advisory: NVD published CVE-2026-16347