Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

Network operators and businesses that rely on MikroTik equipment face the loss of full control over their traffic as a newly disclosed flaw enables hijacking of routers. Cybernews reported that MikroTik RouterOS contains a flaw that leaves Internet‑exposed SSH services accessible without any authentication, opening a direct path into the device. Subsequent coverage added depth.

CyberSecurityNews documented active exploitation in the wild, noting that attackers can obtain complete network access once inside. CERT Polska published technical details of the vulnerabilities affecting multiple RouterOS versions. The Hacker News described the method as a hijack of routers through unauthenticated SSH, confirming that the threat is already operational.

While most outlets stress the absence of authentication as the core issue, Security Affairs’ focus on the “-2” SSH user suggests an additional indicator that may be used to confirm intrusion, a nuance not highlighted elsewhere. No outlet reports a patched mitigation as already deployed. The collective advisories currently advise immediate restriction of Internet‑facing SSH, firmware updates where available, and review of access logs.