Office routers (MikroTik) are being taken over through SSH.

What's happening.

MikroTik RouterOS is the software on MikroTik routers, which many small offices use. A flaw in its SSH service lets someone with no login open a session and run a command after a re-key request. It can be chained with other flaws to take full control of the router.

CERT Polska, the Polish national CERT, reports attackers are using the chain against routers whose SSH service can be reached from the internet. Its first fixed builds, 7.24.2 and 7.23.4, left a related flaw (CVE-2026-67278) only partly fixed.

What it means for you.

A router controls everything that goes in and out of your office. A hijacked router lets attackers watch or redirect traffic, create their own admin accounts and reach devices on your network.

How to fix it.

1. Update RouterOS to 7.24.3 or later (stable channel), 7.23.6 or later (long-term channel), or 6.49.21 or later (version 6). Builds 7.24.2 and 7.23.4 need updating again.
2. Block SSH, the web admin pages and the bandwidth-test server from everywhere except your trusted management network.
3. Look for a failed SSH login by a user called -2 in the logs, and for a high-privilege account called ops. CERT Polska says the lack of these signs does not rule out a break-in.
4. If you find signs of compromise, treat the router as untrusted. Reset it, set new passwords and keys, and review what it could reach.
5. Avoid using the built-in SSH client on unpatched routers, especially over untrusted networks.