IM
IronMonkey Threat Research
‹ Back to ICS Advisories

MikroTik RouterOS and Cloud Hosted Router

HIGH
CVSS 8.8
Date 2026-07-28T06:00:00+00:00
Source cisa-csaf
Published by CISA

// Description

Successful exploitation of this vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2026-16347 8.8 high
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts. This deficiency increases the risk that an attacker could eventually obtain valid credentials and gain unauthorized access to administrative services.

// Affected Products (2)

Vendor Product Asset Type Purdue Level Firmware
MikroTik Unknown network_device -- --
MikroTik Unknown network_device -- --

// Remediations (8)

Mitigation: Keep the default randomly generated device password, or replace it with an equally strong one, since
Keep the default randomly generated device password, or replace it with an equally strong one, since minimum complexity isn't enforced by default.
Mitigation: Use long, randomly generated passwords rather than weak or default-simple ones, to keep the brute-fo
Use long, randomly generated passwords rather than weak or default-simple ones, to keep the brute-force search space impractically large.
Mitigation: Connect initially from a trusted network (LAN) port only, then configure the router per your securit
Connect initially from a trusted network (LAN) port only, then configure the router per your security requirements.
Mitigation: Configure the unsuccessful-attempt time range (0.1 to 0.5 seconds) in /ip service for all services,
Configure the unsuccessful-attempt time range (0.1 to 0.5 seconds) in /ip service for all services, including the API, once available.
Mitigation: Restrict/limit access to management services from untrusted networks.
Restrict/limit access to management services from untrusted networks.
Mitigation: No fix is currently available from MikroTik. Until a fix is available, MikroTik recommends that user
No fix is currently available from MikroTik. Until a fix is available, MikroTik recommends that users adopt the following mitigations: Use a strong VPN or other additional protection layer if the API is exposed to public networks.
Mitigation: Users are encouraged to reach out to MikroTik (https://mikrotik.com/support) for further support.
Users are encouraged to reach out to MikroTik (https://mikrotik.com/support) for further support.
Mitigation: Apply firewall rules to control and restrict access to management services where possible.
Apply firewall rules to control and restrict access to management services where possible.

// References