MikroTik released patches in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21 and advises against enabling the SSH service on the internet interface. Despite this not being the default configuration, over 122,500 MikroTik devices have SSH reachable from the internet according to scans performed by the Shadowserver Foundation, with the highest numbers in Brazil, the US, and Indonesia.
Based in Latvia, MikroTik makes routers, switches, and other networking devices for a wide range of customers, from small businesses to large enterprises. Its products are used across many sectors, including telecommunications, education, and government.
“If you have manually opened this port [SSH], make sure only trusted IP can access it, or better yet, use a strong VPN like WireGuard to access your router and do not open any management ports at all,” the company says in its advisory. “RouterOS will check if your device has been compromised, and set it to ‘Flagged’ status if it is. This will be written in the ‘Log’ section.”
